CVE-2026-65616: Improper Verification of Cryptographic Signature

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

PT-2026-65363

Gitea: OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes in gitea.dev...

CVE-2026-17569: Insufficiently Protected Credentials

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

PT-2026-65106

Name of the Vulnerable Software and Affected Versions JFrog affected versions not specified Description Incorrect authorization validation in the refresh token signature allows users without administrative privileges to obtain a signed JFrog administrator token, leading to potential privilege...

CVE-2026-42016: Incorrect Authorization

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

PT-2026-64846

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...

PT-2026-65376

Gitea: OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation in gitea.dev...

PT-2026-65081

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 Devolutions Server versions 2026.1.23.0 and earlier Description Improper access control in the NetBox synchronizer allows an authenticated user with view-only permission on an entry to...

MiracleLinux 9 : fence-agents-4.10.0-110.el9_8.3 (AXSA:2026-1350:10)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1350:10 advisory. python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens CVE-2026-48526 Tenable has extracted the preceding description block directly from t...

PT-2026-65055

OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3...

PT-2026-65102

Name of the Vulnerable Software and Affected Versions JFrog Artifactory Self Hosted versions prior to 7.133.11 Description An incorrect authorization validation of the user token allows for privilege escalation. The issue occurs because the system performs a validation check on the token signatur...

CVE-2026-14235: Improper Access Control

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...

PT-2026-65097

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

PT-2026-65051

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callback mode=direct configured are vulnerable to XSS via the error description parameter on the page for a failed...

PT-2026-65357

Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...

PT-2026-65369

Gitea Remember-Me Token Theft Not Invalidating Attacker Session in gitea.dev...

macOS 26.x < 26.6 Multiple Vulnerabilities (128067)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.6. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6...

PT-2026-65052

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and disable binding=true is set, attempts to verify the current request's presented mTLS certificate matches the original. Tok...

PT-2026-64876

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

CVE-2026-16481: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...