CVE-2026-59358 UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

Improper authentication CWE-287 in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged clientcredentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer...

CVE-2026-59358

Cloud Foundry UAA (v3.7.0 to v79.6.0) and CF Deployment (up to v60.4.0) are vulnerable to an Improper Authentication (CWE-287) flaw in the OAuth token endpoint. The system fails to verify if a Bearer credential is a legitimate client secret, instead accepting any valid access token where the clie...

cve-2024-55591-poc

CVE-2024-55591 - Fortinet FortiOS 認証バイパス CVE-2024-55591 （Fortinet FortiOS に影響する認証バイパス脆弱性）の技術的メカニズムを実演する、Go で書かれた教育目的の実装です。このリポジトリは、セキュリティ研究、防御的分析、および許可されたペネトレーションテストのみを目的としています。 動作の仕組み このツールは、脆弱性のワークフローを反映した2つの主要フェーズ（ターゲット検証と悪用）で構成されています。 フェーズ 1: ターゲット検証と検出 1. 管理インターフェースのプロービング: /login?redir=/ng...

CVE-2026-73312

CVE-2026-73312: Refresh token replay after access-token expiry XenForo before 2.3.13 can leave an OAuth2 refresh token reusable when its parent access token has expired. What happens XenForo intentionally lets a refresh token outlive its short-lived access token. During rotation it creates the...

CVE-2026-71206-PoC

CVE-2026-71206 — Shiori: JWT CheckToken はアカウント状態を再検証しない 製品: go-shiori/shiori ファイル: internal/domains/auth.go CWE: CWE-613 — 不十分なセッション有効期限 CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L — 8.2 高 CNA: Turan Security · CVE レコード 説明 Shiori の CheckToken 関数（internal/domains/auth.go）は、JWT の HMAC...

CVE-2026-56291

CVE-2026-56291 — Balbooa Forms Joomla 大量RCE エクスプロイト 事前認証なし form.uploadAttachmentFile → CSRFなし → PHPアップロード 概要 CVE-2026-56291 は、Balbooa Forms combaforms Joomla 拡張機能 CISA KEV: 2026年7月10日追加 — 積極的な悪用が確認されました。 脆弱性メカニズム 根本原因 // FormModel::uploadAttachmentFile frontend/models/forms/FormModel.php L122 //...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

PT-2026-106360

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA affected versions not specified Description Improper authentication in the OAuth token endpoint allows a remote, authenticated attacker with a valid user access token to obtain a fully-privileged client credentials token for...

PT-2026-106796

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version...

PT-2026-106775

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.12.0 through 1.30.1 @modelcontextprotocol/client versions 2.0.0 through 2.1.0 Description The SDK's OAuth client support allows an MCP server to determine which authorization server receives the client's...

EUVD-2026-89334

simple-git unsafe-operation guard does not block trailer command configuration...

EUVD-2026-88547

PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783

The Joplin note-taking application (prior to version 3.7.13 ) is vulnerable to cross-origin theft of a permanent API token when the optional Web Clipper server is enabled. The root cause is located in packages/lib/ClipperServer.ts, where the server sends Access-Control-Allow-Origin: * and fails t...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105783 Joplin Web Clipper pairing allows cross-origin theft of a permanent API token

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2025-25965

CVE-2025-25965: オンライン宴会予約システム v1.2 におけるクロスサイトリクエストフォージェリ CSRF はじめに クロスサイトリクエストフォージェリ CSRF は、今日の Web アプリケーションに影響を与える、最も見落とされがちでありながら危険な脆弱性の 1 つです。CVE-2025-25965 は、Phpgurukul オンライン宴会予約システム v1.2 で新たに発見された CSRF 脆弱性であり、リモートの攻撃者が認証済みセッションを悪用して、ユーザーの同意なしにメールアドレスを変更することを可能にします。 脆弱性概要 CVE ID :...

CVE-2022-3172

CVE-2022-3172 デモ poc.shを実行してリソースを作成 chmod +x poc.sh ./poc.sh Curlを使用 curl https://kubernetes.default.svc/apis/metrics.k8s.io/v2beta1/ -k -H "Authorization: Bearer token"...

CVE-2026-105690

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking the corresponding server-side session. A previously captured session token remains usable after the victim logs out and can continue to make authenticated...

CVE-2026-105675

Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their...