PT-2026-64376

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description A missing object-level authorization issue exists in the JSON-RPC API. This allows holders of API tokens to enumerate account metadata, overwrite passwords, and delete accounts across the entire...

PT-2026-64425

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description An incorrect permission assignment for critical resources in the Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. Recommendations At the...

Ethereum NFT Smart Contracts: Knowledge-Guided Vulnerability Detection with LLM and Code Slicing

Ethereum non-fungible tokens NFTs implement ownership, transfer, authorization, and metadata operations through smart contracts, making contract vulnerabilities a direct risk to digital assets. Existing static analyzers provide efficient rule-based screening but can struggle with...

CVE-2026-61892: Incorrect Permission Assignment for Critical Resource

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges...

PT-2026-67478

Am I affected? You are affected if your application registers the @better-auth/scim plugin and lets authenticated users generate SCIM tokens. The default canGenerateToken policy was affected, and custom policies were affected when they did not reject provider IDs already used by other account...

PT-2026-64307

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description The automation jobs API contains a flaw where sensitive information is included in sent data. An authenticated user with scoped job or script read permissions can obtain...

CVE-2026-16798: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

Rockwell FactoryTalk Services Platform 6.60 Authentication Bypass (SD1786)

The version of Rockwell FactoryTalk Services Platform installed on the remote Windows host is 6.60. It is, therefore, affected by an authentication bypass vulnerability: - A vulnerability exists that allows an attacker to bypass JWT signature validation during Okta Web Authentication. The...

Oracle Linux 10 : tomcat9 (ELSA-2026-25341)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-25341 advisory. - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation CVE-2026-24734 - Resolves: Tomcat: OCSP checks sometime...

PT-2026-64446

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description Cloudreve fails to properly validate WOPI access tokens and enforce requested viewer actions. The system generates tokens in the format ., but the middleware.ViewerSessionValidation function only...

CVE-2024-58354

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2026-47724

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354

Cal.com (cal.com/cal.diy) is affected by a repository takeover via its GitHub Actions workflow. The pr.yml workflow uses pull_request_target and passes repo default write permissions to check-types.yml, which then dangerous-checks out the attacker PR and executes it (yarn install, package.json sc...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

EUVD-2026-48426

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724

Nebula-Mesh (pre-0.3.4) suffers an authorization gap: the /api/v1/* surface largely trusts bearer tokens and enforces ownership only for the Web layer, leaving host, network, firewall, mobile-bundle, and most operator endpoints vulnerable to cross-tenant access. This enables privilege escalation ...