PT-2026-70795

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-73084: Improper Neutralization of Input During Web Page Generation

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-14548: Missing Authorization

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-72537: Improper Privilege Management

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user inges...

PT-2026-70065

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

PT-2026-70868

Name of the Vulnerable Software and Affected Versions acm-search-v2-api-rhel9 affected versions not specified Description A flaw exists where the getFederationConfig function improperly reuses a user's bearer token for all subsequent federated requests during cache refreshes until the cache...

PT-2026-70784

Name of the Vulnerable Software and Affected Versions anoid versions prior to 3.3.12 anoid versions prior to 5.1.11 Description The nanoidsize function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer. Providing a value of 2147483648 causes it to...

CVE-2026-48767: Exposure of Sensitive Information to an Unauthorized Actor

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

PT-2026-70026

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter fails to sufficiently validate certain token content under specific configurations. An unauthenticated attacker can send a specially crafted token to force the transmissio...

PT-2026-70869

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where the application logs request headers upon receiving a non-200 response. This process may expose the cloud.openshift.com pull-secret token. A local user with access...

PT-2026-70359

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-58230: URL Redirection to Untrusted Site

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to...

CVE-2026-15567: Memory Allocation with Excessive Size Value

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

PT-2026-70927

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

PT-2026-70096

Name of the Vulnerable Software and Affected Versions Wildfly affected versions not specified Description A remote unauthenticated attacker can trigger an OutOfMemoryError. This occurs because the GSS token decoder in CSIv2Util reads a length field controlled by the attacker without performing...

PT-2026-70871

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists in the setDefault function that logs the value of every environment variable it processes. This includes CCX TOKEN, a bearer credential used in disconnected cluster...

PT-2026-70115

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...

PT-2026-70358

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...

CVE-2026-73085: Improper Authentication

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...