95573 matches found
CVE-2026-18363
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...
CVE-2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...
CVE-2026-18363 Weak password recovery mechanism in osTicket by Enhancesoft LLC
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...
Incorrect Authorization
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Authorization due to claim handling in the UMA claim-token evaluation path. An attacker can access...
EUVD-2026-51066
PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...
CVE-2026-18353
PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...
Token / Secret Hunter
Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL and DOM from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Token / Secret Hunter", "description": "Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL...
Vulnerabilities are handled in GitLab through GitLab Inc.
GitLab Inc. has addressed several vulnerabilities in GitLab, particularly in versions prior to 19.0.5, 19.1.3, and 19.2.1, including those of the GitLab Enterprise Edition EE. These vulnerabilities concern various aspects of GitLab: - Improper access control, allowing authenticated users to acces...
PT-2026-66460
Name of the Vulnerable Software and Affected Versions koku-metrics-operator for Red Hat OpenShift affected versions not specified Description A flaw exists in the CostManagementMetricsConfig custom resource. A user with permissions to edit this resource can specify an arbitrary upload URL. The...
CVE-2026-52539
Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...
PT-2026-66464
Name of the Vulnerable Software and Affected Versions CentreStack versions prior to 17.5 Description The software contains a hardcoded cryptographic key. Unauthenticated attackers can exploit a static SysNumber value used as entropy for the AccessTicket.Encrypt and AccessTicket.Decrypt functions...
PT-2026-66607
Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The software fails to perform ownership or session checks when looking up sequential orderId...
PT-2026-66451
A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period ha...
PT-2026-66591
Name of the Vulnerable Software and Affected Versions Outstatic CMS versions prior to 2.2.0 Description The application contains a hardcoded JSON Web Token JWT signing secret. If the OST TOKEN SECRET environment variable is not configured, the system uses a default secret available in the public...
PT-2026-66491
Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication client secret jwt and...
EUVD-2026-51327
Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...
PT-2026-66459
Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...
CVE-2026-18378: Server-Side Request Forgery (SSRF)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...
CVE-2026-18381: Server-Side Request Forgery (SSRF)
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...
