CVE-2026-95654

Databasement before 1.7.14 is affected by an authorization bypass via stale invitation tokens . The vulnerability resides in the invitation acceptance flow (AcceptInvitation.php), where the system validates the token only when the page loads and caches the authorization decision without re-checki...

CVE-2026-95654 Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation aft...

CVE-2026-95654 Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation aft...

CVE-2026-95654 Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation aft...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

EUVD-2026-84524

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

CVE-2026-80154

CVE-2026-80154 affects all firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 . The vulnerability resides in the web management portal , where session tokens are generated deterministically from the device model and current time at one-second resolution , yield...

CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

EUVD-2026-84520

All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent...

Unmasking EvilTokens: Getting to the root of device code phishing

In this article 1. What is device code phishing? 2. EvilTokens platform and operations 3. EvilTokens phishing emails 4. Mitigation and protection guidance 5. Microsoft Defender XDR detections 6. Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most...

Unmasking EvilTokens: Getting to the root of device code phishing

In this article 1. What is device code phishing? 2. EvilTokens platform and operations 3. EvilTokens phishing emails 4. Mitigation and protection guidance 5. Microsoft Defender XDR detections 6. Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most...

EUVD-2026-84115

Sync-in Server has a complete 2FA Bypass via POST /api/auth/token...

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Affected component: Sync-in Server v2.3.0, POST /api/auth/token auth.controller.ts:50-55. Required attacker capability: Valid username and password for a 2FA-enabled account. Summary POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns unrestrict...

GHSA-92CR-JXW4-5WJG Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Affected component: Sync-in Server v2.3.0, POST /api/auth/token auth.controller.ts:50-55. Required attacker capability: Valid username and password for a 2FA-enabled account. Summary POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns unrestrict...

io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...