CVE-2026-82645

AVideo (commit e01e41ecc and earlier) is vulnerable to unauthenticated stream credential disclosure via the getLiveKey.json.php endpoint. Supplying a forged token parameter bypasses both the access gate and ownership check, returning any user's stream_key and stream_url — credentials for external...

EUVD-2026-68231

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Liverestreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller

CitrixBleedCVE-2026-8452-2025-5777 CitrixBleed Exploit To...

CVE-2026-15980

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-15980

The MyHome Core WordPress plugin (all versions ≤ 4.4.5) contains an Authentication Bypass caused by missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. Unauthenticated attackers can generate an activation token for an unconfirmed user ac...

CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-15980 MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

EUVD-2026-68149

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the sendlink AJAX handler and improper token validation in the activate function. This makes it possible for unauthenticated attackers t...

CVE-2026-75759

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

SUSE CVE-2026-75889

Grafana Alloy's prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759

erlef oidcc is an Erlang OpenID Connect client library. In versions 3.2.0-beta.1 through before 3.9.0 , an improper verification of cryptographic signature flaw allows an unauthenticated attacker to impersonate an arbitrary user by submitting an encrypted ID token or JARM response that contains n...

EEF-CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Summary Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token ...

EUVD-2026-68145

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

PT-2026-83571

AVideo current commit e01e41ecc and earlier exposes stream credentials through the plugin/Live/view/Live restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream access gate and the restream ownership check, causing the endpoint to return any...

PT-2026-83516

Name of the Vulnerable Software and Affected Versions oidcc versions 3.2.0-beta.1 through 3.8.9 Description Improper verification of cryptographic signatures allows an unauthenticated attacker to impersonate any user. The issue occurs when the software accepts a JSON Web Encryption JWE wrapping...

PT-2026-83520

Name of the Vulnerable Software and Affected Versions MyHome Core versions prior to 4.4.6 Description An authentication bypass exists in the MyHome Core plugin for WordPress. The issue stems from missing authorization in the send link AJAX handler and improper token validation within the activate...