CVE-2026-40205: Improper Authentication

An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the configuration, the remote token validation paths accept a token that carries only one of them, while the local token validation path correctly...

Linux Distros Unpatched Vulnerability : CVE-2026-80179

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed...

CVE-2026-78174

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover . The vul...

CVE-2026-78174 WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover...

CVE-2026-78174 WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover...

CVE-2023-32315-java7-

CVE-2023-32315 0x01 Die zurückgegebene JSESSIONID und csrftoken abrufen und ein Anforderungspaket zum Hinzufügen eines Benutzers erstellen JSESSIONID und csrftoken ersetzen img.png root@kitploit: cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02...

EUVD-2026-63467

WebOb: Open redirect in Location header normalization via leading C0 control / space characters...

CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

CVE-2026-76945 Ebyte NE2-D11 Use of Client-Side Authentication

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

CVE-2026-76945

CVE-2026-76945 affects the Ebyte NE2-D11 device. The root cause is client-managed authentication tokens without sufficient server-side validation , allowing an attacker to replay or manipulate tokens to gain unauthorized access to administrative functionality . The primary impact is confidentiali...

CVE-2026-76179

CVE-2026-76179 affects the Ebyte NE2-D11 and certain other Ebyte gateway products. The vulnerability stems from insufficient protection of authentication tokens used by the web management interface, specifically through the use of GET request methods with sensitive query strings during client-sid...

CVE-2026-76179 Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

CVE-2026-76179 Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session informati...

EUVD-2026-67278

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-80179 Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token can force the JWE.deserialize function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of...

CVE-2026-39944 Ceph: CephX AES Authentication error

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

CVE-2026-39944 Ceph: CephX AES Authentication error

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

EUVD-2026-67315

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

CVE-2026-39944

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

CVE-2026-81731

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...