CVE-2026-80154

CVE-2026-80154 affects all firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 . The vulnerability resides in the web management portal , where session tokens are generated deterministically from the device model and current time at one-second resolution , yield...

CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

Unmasking EvilTokens: Getting to the root of device code phishing

In this article 1. What is device code phishing? 2. EvilTokens platform and operations 3. EvilTokens phishing emails 4. Mitigation and protection guidance 5. Microsoft Defender XDR detections 6. Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most...

Unmasking EvilTokens: Getting to the root of device code phishing

In this article 1. What is device code phishing? 2. EvilTokens platform and operations 3. EvilTokens phishing emails 4. Mitigation and protection guidance 5. Microsoft Defender XDR detections 6. Hunting queries Following its emergence in February 2026, EvilTokens quickly became one of the most...

EUVD-2026-84115

Sync-in Server has a complete 2FA Bypass via POST /api/auth/token...

Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Affected component: Sync-in Server v2.3.0, POST /api/auth/token auth.controller.ts:50-55. Required attacker capability: Valid username and password for a 2FA-enabled account. Summary POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns unrestrict...

GHSA-92CR-JXW4-5WJG Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

Affected component: Sync-in Server v2.3.0, POST /api/auth/token auth.controller.ts:50-55. Required attacker capability: Valid username and password for a 2FA-enabled account. Summary POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns unrestrict...

io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor

Mac security researcher Patrick Wardle says it’s trivial to turn Muse into “the ultimate backdoor.” Increasingly, AI assistants are changing from tools that simply answer questions into agents that can plan tasks, use connected services, and take actions for us. These actions might include bookin...

CVE-2026-90882

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

CVE-2026-90882 Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

EUVD-2026-84343

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

CVE-2026-90882 Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

CVE-2026-90882

CVE-2026-90882 affects the open-vsx.org deployment. The CDN/edge layer (not the Open VSX application) reflected the requesting origin in Access-Control-Allow-Origin alongside Access-Control-Allow-Credentials: true on authenticated /user/ endpoints. This allowed a page on any origin to issue crede...

Capable yet Parsimonious: Extracting and Characterizing Hidden Chain-Of-Thought in Frontier Models

The rapid capability gains of frontier language models are widely attributed to improved reasoning abilities, yet this cannot be verified as raw CoT traces in closed-source systems are hidden. By registering a simple custom tool through a standard API feature, we induce frontier models to...

CVE-2026-90882: Permissive Cross-domain Policy with Untrusted Domains

The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin together with Access-Control-Allow-Credentials: true on the authenticated /user/ endpoints. A page on any origin could therefore issue credentialed requests to the service in a logged-in user's brows...

PT-2026-97036

Name of the Vulnerable Software and Affected Versions wlc versions prior to 2.0.1 Description The command-line client can send an unscoped API token to an attacker-controlled server when executed within an untrusted repository, pull request checkout, or a directory containing untrusted ancestor...

PT-2026-96900

Name of the Vulnerable Software and Affected Versions mcp-atlassian versions prior to 0.22.0 Description The HTTP transport in mcp-atlassian accepts requests without a verified user identity. When no valid user token is provided, the system falls back to using the operator's globally configured...