CVE-2026-75035 Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

CVE-2026-75035

SUSE Rancher Manager is affected by a flaw in the ext.cattle.io/v1 Token store where a crafted label selector causes the internal owner filter to be dropped, allowing any authenticated user (with the built-in User or User Base role) to list and watch other users' tokens. Exposed data includes tok...

CVE-2026-75035 Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

CVE-2026-75035 Rancher: ext.cattle.io/v1 Token store: cross-user token disclosure via label-selector scoping bypass

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

EUVD-2026-70517

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

CVE-2026-85174

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-85162

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacki...

CVE-2026-85160

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

CVE-2026-85154

WWBN AVideo contains an authentication failure vulnerability where the videoidhash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a videoidhash can replay it indefinitely to authenticate as...

CVE-2026-85155

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this orderi...

CVE-2026-84832

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...

quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache

A flaw was found in Quarkus OIDC. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass...

quarkus-oidc: Quarkus OIDC: Cross-tenant authentication bypass via shared token-introspection cache

A flaw was found in Quarkus OIDC. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass...

USN-8718-1 sssd vulnerability

It was discovered that SSSD did not properly validate authentication token lengths when processing PAM responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a denial of service...

USN-8718-1: SSSD vulnerability

It was discovered that SSSD did not properly validate authentication token lengths when processing PAM responder requests. A local attacker could possibly use this issue to cause SSSD to crash, resulting in a denial of service...

CVE-2026-85174 SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-85174 SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-85174 SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

EUVD-2026-70409

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-85174

SiYuan before v3.8.2 is vulnerable to API token exposure via its log file. When full-text search requests exceed timing thresholds, API tokens passed in query parameters are written in plaintext to an accessible log file. An authenticated attacker can retrieve the log file through the getFile end...