PT-2026-93257

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 10.0.9 Description The software uses the PHP rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs. Because rand is not a cryptographically secure generator, remote...

VulnCheck KEV: CVE-2026-66047

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

CVE-2026-85387: Insufficient Session Expiration

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly...

PT-2026-93781

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Server Integration Plugin versions prior to 6.0.2 Description The OAuth authorization endpoint reads the oauth callback URL from the submitted form instead of using the server-side stored request token. This flaw allows...

CVE-2026-92138: Insufficient Verification of Data Authenticity

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92764: Incorrect Authorization

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

CVE-2026-92787: Use of Hard-coded Credentials

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write...

CVE-2026-92133: Insufficiently Protected Credentials

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

Cache confusion in gitlab-plugin

gitlab-plugin allows jobs to override the globally configured GitLab API token credentials with an alternative one, and caches the GitLab API client it builds for those credentials. gitlab-plugin 1.2149.vcfc32c82bf7f and earlier derives the cache key from the credentials ID alone, omitting the...

OAuth access token hijacking via callback URL manipulation in atlassian-bitbucket-server-integration

atlassian-bitbucket-server-integration implements an OAuth provider for Bitbucket Server. The OAuth authorization endpoint in atlassian-bitbucket-server-integration 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token. An...

PT-2026-93285

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

PT-2026-93696

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 Description A cross-site request forgery CSRF issue exists in the 'portal.cgi' component. The anti-CSRF mechanism fails to validate the csrf token value parameter, accepting any...

PT-2026-93310

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

CVE-2026-92717: Missing Authentication for Critical Function

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts,...

PT-2026-94001

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software. This flaw results from improper management of th...

PT-2026-93414

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.10.0 Description The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, rather than restricting it to the client...

SUSE SLES15 Security Update : perl-Mojolicious (SUSE-SU-2026:4151-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4151-1 advisory. This update for perl-Mojolicious fixes the following issue: - CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH...

Rauthy -- Multiple security vulnerabilities

The Rauthy project reports: WebAuthn authentication code is not bound to the user. GHSA-x8jp-v2j6-6vjf Refresh-token grant accepts a caller-supplied client without verifyinG it matches the token's azp, allowing cross-client token minting and identity/scope confusion...

PT-2026-93776

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Plugin versions prior to 1.2149.vcfc32c82b f7f Description The plugin caches the GitLab API client for alternative GitLab API token credentials using a cache key based solely on the credentials ID, failing to include the folder...

PT-2026-93421

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description The Authentik OAuth path in the FAB auth manager fails to validate the issuer or audience claims of the accepted id token. This allows an attacker who possesses a valid token...