82469 matches found
MAL-2026-6473 Malicious code in colorpicker-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140 Package presents itself as a minimal React color-picker but ships a postinstall hook "postinstall": "node setup.js" that performs targeted credential...
Malicious code in colorpicker-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140 Package presents itself as a minimal React color-picker but ships a postinstall hook "postinstall": "node setup.js" that performs targeted credential...
CVE-2026-56767
Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Google and Airtable access tokens, modify, delete, or execute...
CVE-2026-56768
Seahub before 13.0.23 does not enforce SHARELINKLOGINREQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.4 Security Update
New Red Hat build of Keycloak 26.6.4 packages are available from the Customer Portal Red Hat build of Keycloak 26.6.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...
keycloak: Keycloak: Attacker can re-enable and take over disabled clients via Registration Access Token
A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token RAT, could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker...
GO-2026-5291 nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node
nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token in github.com/nuts-foundation/nuts-node...
GO-2026-5350 Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding) in github.com/cloudreve/Cloudreve
Cloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation Insecure PRNG Seeding in github.com/cloudreve/Cloudreve...
GO-2026-5339 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth in github.com/open-telemetry/opentelemetry-operator
OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth in github.com/open-telemetry/opentelemetry-operator...
GO-2026-5391 ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider in github.com/zitadel/zitadel
ZITADEL: Missing Token Audience Validation aud in JWT IdP Provider in github.com/zitadel/zitadel...
GO-2026-5382 Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass in github.com/lin-snow/ech0
Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...
GO-2026-5364 Oxia has an OIDC token audience validation bypass via SkipClientIDCheck in github.com/oxia-db/oxia
Oxia has an OIDC token audience validation bypass via SkipClientIDCheck in github.com/oxia-db/oxia...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization through the web archive download endpoint. An attacker can access resources beyond their authorized token scope by sending crafted requests to this endpoint. Remediation Upgrade...
GO-2026-5375 ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0
ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI in github.com/lin-snow/ech0...
GO-2026-5349 free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf
free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types in github.com/free5gc/nrf...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization through the web archive download endpoint. An attacker can access resources beyond their authorized token scope by sending crafted requests to this endpoint. Remediation Upgrade...
GO-2026-5299 Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea
Gitea: OAuth2 access token scope enforcement bypass via HTTP Basic authentication in code.gitea.io/gitea...
GO-2026-5326 free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef
free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef...