CVE-2026-73431

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

EUVD-2026-57226

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-73431 Reusable Account Activation and Recovery Tokens Allow Repeated Account Takeover in vulnerability-lookup

Vulnerability-Lookup contains an authentication weakness in its account activation and password-recovery mechanism. Activation and recovery links were generated using stateless signed tokens containing only the user's login. Although the token signature and age were validated, the application did...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

EUVD-2026-57220

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-50561

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-50561

Summary: CVE-2026-50561 affects Yuxi prior to 0.6.2 where the Authorization header token is only authenticated for validity, not validated across deployments. This enables an administrator token from one deployment or local test environment to gain access to the backend management interfaces of a...

CVE-2026-50561 Yuxi has a JWT Authentication Bypass Leading to Cross-Instance Administrator Token Reuse

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header —...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233

CVE-2026-47233 details an incomplete fix in Admidio where field_delete in modules/inventory.php validates only a CSRF token and does not enforce isAdministratorInventory(), allowing any logged-in user to delete non-system inventory fields. The related ItemField::delete() path lacks an admin check...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47233 Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...

CVE-2026-47229

CVE-2026-47229 affects Admidio before 5.0.10. The code for SSO client state changes (/modules/sso/clients.php) does not validate a CSRF token in the enable path and accepts plain GET requests to toggle SAML/OIDC clients. An authenticated admin can be tricked into disabling or re-enabling a config...

CVE-2026-17008

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...

Exploit for CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Refere...

CVE-2026-11325 cloudflare/pages-action is deprecated — migration required by September 18th, 2026

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

CVE-2026-17008 Quick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...