95095 matches found
CVE-2026-56654: Improper Access Control
Privilege Escalation via Access Token Scope Escalation in API...
PT-2026-71848
Name of the Vulnerable Software and Affected Versions IBM Documentation Offline versions 1.0.0 through 1.4.1 Description A remote attacker can forge valid session tokens because the software uses a hardcoded cryptographic key. A hardcoded cryptographic key is a fixed secret embedded directly into...
CVE-2026-58431: Incorrect Authorization
Public-only API token restriction is not enforced on team API routes...
PT-2026-71613
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/zcrypt component where the cca ecc2protkey function derives the copy length for the CPRB parameter block directly from the length field in the key token. This...
CVE-2026-68452
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests ccacipher2protkey derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length...
PT-2026-71439
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for...
PT-2026-76574
Name of the Vulnerable Software and Affected Versions Etherpad versions 2.6.0 through 3.0.0 Description An issue exists in the device-to-device author-token transfer mechanism. The system uses the POST /tokenTransfer endpoint to store an author token and exposes it via the GET /tokenTransfer/uuid...
PT-2026-71699
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level...
CVE-2026-24059: Improper Privilege Management
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...
CVE-2026-50105: Exposure of Sensitive Information to an Unauthorized Actor
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
PT-2026-76006
Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body Description Etherpad ships an endpoint pair under /tokenTransfer src/node/hooks/express/tokenTransfer.ts that lets a logged-in user move their...
PT-2026-71914
Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...
PT-2026-71836
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens...
CVE-2026-58425: Exposure of Sensitive Information to an Unauthorized Actor
OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation...
PT-2026-76575
Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...
PT-2026-71388
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the get advance file by url method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token...
PT-2026-71829
Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions because of improper validation of anti-CSRF tokens. Cross-Site Request Forgery CSRF is a type of attack that tricks a victim into...
PT-2026-71718
Name of the Vulnerable Software and Affected Versions Rainbond versions prior to 6.9.8 Description Broken access control exists in the CheckToken function. Authenticated attackers can access unauthorized enterprise resources by substituting another enterprise's tenant name within URL paths. By...
PT-2026-71615
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/zcrypt component where CCA token structures contain user-controlled len fields that are used without proper validation against the actual buffer size and...