CVE-2026-102364

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-81930: Insufficiently Protected Credentials

Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...

CVE-2026-102364: Improper Authentication

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102422: Improper Neutralization of Special Elements used in an OS Command

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

CVE-2026-102422

shell-quote's quote function emits a comment token as followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator \n, \r, U+2028, U+2029 in that later string therefore ends the comment, and the rest of the string is...

PT-2026-102669

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

CVE-2026-102371

In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by executing the pro client with the Ubuntu Pro token passed as a command-line argument pro attach . On systems where /proc is mounted without...

CVE-2026-100289: Missing Authorization

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...

PT-2026-102618

Name of the Vulnerable Software and Affected Versions wsl-pro-service versions prior to 0.1.19ubuntu3 Description A service component running as root within a WSL instance attaches the instance to Ubuntu Pro by executing the pro client and passing the Ubuntu Pro token as a command-line argument. ...

PT-2026-102742

File owners were unable to unlock TYPE TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database...

PT-2026-102739

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due ...

CVE-2026-102367: Insufficient Session Expiration

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...

CVE-2026-101269: Improper Authentication

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

PT-2026-102517

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

PT-2026-102812

Name of the Vulnerable Software and Affected Versions simple-git versions 3.15.0 through 4.0.0 Description The default blockUnsafeOperationsPlugin fails to classify trailer..cmd as an unsafe configuration. This allows an attacker to execute arbitrary shell commands with the operating-system...

SUSE CVE-2026-67237

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the...

SUSE CVE-2026-67242

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isintegerExp guard skips token-expiry checks for float exp. validatetokenexpiry/1 lines 208-214 and expirytimestamp/1 138-144 both guard with 'when isintegerExp' and fall through to ok/never for float values...

SUSE CVE-2026-76578

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

CVE-2026-102367

The mall4j framework (versions through 4.0 ) is vulnerable to an insufficient session expiration issue within the token refresh endpoint . The root cause is a failure to validate the enabled flag when issuing new sessions via the POST /token/refresh endpoint. Consequently, users with disabled acc...

CVE-2026-102367 mall4j through 4.0 Insufficient Session Expiration via Token Refresh

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag when issuing new sessions. Disabled user accounts can indefinitely renew their sessions through the POST /token/refresh endpoint, retaining access tha...