Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Security Bypass.

Summary golang-jwt/jwt is used by IBM Storage Fusion Data Foundation, which could cause Security Bypass. CVE-2024-51744, CVE-2025-30204. Vulnerability Details CVEID:CVE-2024-51744 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in...

Exploit for CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass...

SUSE CVE-2026-79780

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-18550

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests when using apiCall service mode , without requiring explicit authorization headers. An attacker can exploit this by directing apiCall requests to external or attacker-controlled ...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

EUVD-2026-69032

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

CVE-2026-84195 Kyverno before 1.16.4 Credential Leak via apiCall

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests to external or attacker-controlled endpoints,...

EUVD-2026-69030

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

EUVD-2026-69021

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550

The Nokri - Job Board WordPress Theme (versions ≤ 1.6.6 ) is vulnerable to unauthenticated privilege escalation via account takeover. The root cause is insufficient reset token validation in the nokri_reset_password() function: an empty attacker-supplied reset token matches empty or unset sb_pass...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-18550 Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter

The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the nokriresetpassword function, which allows empty attacker-supplied reset tokens to...

CVE-2026-81722

A flaw was found in the nltk PorterStemmer component. A remote attacker could exploit this vulnerability by providing a specially crafted, untrusted token. The inefficient algorithmic complexity in the stemming process, specifically within the isconsonant and measure helper functions, causes...

Improper Authentication

Apache Hive is vulnerable to improper authentication. The vulnerability is due to improper validation of SAML bearer tokens, which allows an unauthenticated network attacker to forge an Authorization: Bearer token and authenticate as an arbitrary Hive user, thereby obtaining an authenticated...

CVE-2026-40205

A flaw was found in Dovecot. An attacker with a partially valid OAuth2 token can bypass authorization checks in remote token validation paths. This allows the attacker to authenticate with insufficient permissions, leading to a breach of integrity where the configured authorization policy is not...

WordPress Nokri - Job Board WordPress Theme plugin <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter vulnerability

WordPress Nokri - Job Board WordPress Theme plugin = 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter vulnerability discovered by d.v4ns3c in WordPress Theme Nokri versions = 1.6.6...