CVE-2026-19625

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

Exploit for Missing Authentication for Critical Function in Flowiseai Flowise

CVE-2025-58434 - Flowise CVE-2025-58434 unauthenticated acco...

CVE-2026-19625

CVE-2026-19625 is a cross-tenant authentication bypass in the OIDC extension of IBM Enterprise Build of Quarkus . When an optional token-introspection cache is enabled, a valid token issued by one OIDC provider tenant can be used to access endpoints secured by a different tenant, because the shar...

CVE-2026-19625 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

EUVD-2026-74190

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

CVE-2026-19625 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685 Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

CVE-2026-84685

The react-native-auth0 SDK 's web platform implementation fails to scope its in-memory token cache to individual user sessions in server-side rendering (SSR) environments where module state persists across HTTP requests. As a result, tokens cached in module memory can be retrieved by subsequent r...

EUVD-2026-74189

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory OIDC ID token decoders in the Spring Cloud Azure OAuth2 login components. An attacker can elevate privileges and sign in as an...

EUVD-2026-64019

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname...

GHSA-6X6C-W9W9-HV4H Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Impact Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that...

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Impact Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that...

Origin Validation Error

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Origin Validation Error due to missing issuer and audience validation in decodeandvalidateazurejwt in...

WordPress ilGhera Reviso Exporter for WooCommerce plugin <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function vulnerability

Missing Authorization to Authenticated Subscriber+ Agreement Grant Token Deletion via disconnectcallback Function vulnerability discovered by Legion Hunter in WordPress Plugin ilGhera Reviso Exporter for WooCommerce versions = 1.2.3...

CVE-2026-86073

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it...

CVE-2026-75156

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

Insufficiently Protected Credentials

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the WORKLOADIDENTITY authenticator through AuthByWorkloadIdentity.prepare in src/snowflake/connector/auth/workloadidentity.py. An...

CVE-2026-86073

n8n , an open source workflow automation platform, is affected by a per-resource OAuth consent bypass prior to versions 2.37.7 and 2.38.1 . The OAuth token endpoint bound the initial access token to the consented resource but did not bind the refresh token ; upon refreshing, it only verified the ...