91653 matches found
PT-2026-90253
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the gss krb5 verify mic v2 function fails to verify the length of the read token-len before accessing the token ID, flags byte, and padding...
PT-2026-89873
An information leakage vulnerability exists in the Endpoint DLP component epdlpdrv.sys of Netskope Client for Windows prior to version R141. An internal communication channel used by the user-space hook DLL to pass messages through the kernel driver to the daemon lacked proper token-based message...
PT-2026-89836
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
PT-2026-90521
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Requests sent from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange fail to verify the server...
JFrog Artifactory Incorrect Authorization Vulnerability
JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...
JFrog Artifactory Improper Authentication Vulnerability
JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...
PT-2026-90054
Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description An issue exists where the system fails to validate an anti-CSRF token a unique token used to prevent Cross-Site Request Forgery, where an attacker tricks a user into performing actions they did...
CVE-2026-18122: Missing Authorization
Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express entry collection endpoint disabled the per-entry view permission check. An OAuth token with read scope for an Express entity could enumerate...
CVE-2026-19486: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...
CVE-2026-82213: Authorization Bypass Through User-Controlled Key
The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...
Linux Distros Unpatched Vulnerability : CVE-2026-87107
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-import...
PT-2026-90266
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SUNRPC component where the svcauth gss unwrap priv function only validates the upper bound of the wire-supplied opaque length len before passing the buffer to gss...
Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...
Incorrect Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization via the OAuth token exchange process. An attacker can retain unauthorized access to roles, including administrative privileges, by exchanging a valid provider access token even after t...
GHSA-WVM9-9G5J-623F Open WebUI: Users denied by the OAuth role policy can still sign in via token exchange
Summary Open WebUI's OAuth token exchange endpoint issues a session for a provider access token without running the OAuth role management that the normal OAuth login callback runs. A user whose provider roles the login callback would refuse, or would demote, could still obtain a working session a...
GHSA-CW9W-VV67-HF73 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...
NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...
n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
Impact The OAuth token endpoint bound an authorization code's first access token to the consented resource, but not its refresh token. Refreshing only checked that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could refres...
