SUSE SLES15 Security Update : perl-Mojolicious (SUSE-SU-2026:4151-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4151-1 advisory. This update for perl-Mojolicious fixes the following issue: - CVE-2026-15747: exposing a stable representation of the session CSRF token to a BREACH...

PT-2026-93307

The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action, allowing unauthenticated attackers to redirect users to arbitrary external sites and to disclose a subscriber token that grants access to that subscriber...

PT-2026-93257

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 10.0.9 Description The software uses the PHP rand function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs. Because rand is not a cryptographically secure generator, remote...

Linux Distros Unpatched Vulnerability : CVE-2026-47426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache witho...

PT-2026-93285

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

PT-2026-93416

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Deactivating a user account does not invalidate tokens issued to that account prior to the deactivation. While password authentication correctly rejects disabled accounts, the Co...

CVE-2026-92764: Incorrect Authorization

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intende...

CVE-2026-92138: Insufficient Verification of Data Authenticity

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92814: Improper Neutralization of Input During Web Page Generation

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-76413: Improper Restriction of Security Token Assignment

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...

PT-2026-94046

Name of the Vulnerable Software and Affected Versions OpenCVE versions 2.4.0 through 3.0.x Description An issue exists where the organizations API endpoint is not properly scoped to the organization associated with the token. Instead, it returns the memberships of the token creator. This allows...

PT-2026-93781

Name of the Vulnerable Software and Affected Versions Jenkins Bitbucket Server Integration Plugin versions prior to 6.0.2 Description The OAuth authorization endpoint reads the oauth callback URL from the submitted form instead of using the server-side stored request token. This flaw allows...

CVE-2026-92133: Insufficiently Protected Credentials

Jenkins GitLab Plugin 1.2149.vcfc32c82bf7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key derived from the credentials ID alone, omitting the folder in which the credentials are resolved, allowing attackers with Item/Configure...

CVE-2026-85387: Insufficient Session Expiration

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confirmed only that a token existed, had not expired, and had not been explicitly...

PT-2026-94001

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software. This flaw results from improper management of th...

PT-2026-93696

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 Description A cross-site request forgery CSRF issue exists in the 'portal.cgi' component. The anti-CSRF mechanism fails to validate the csrf token value parameter, accepting any...

CVE-2026-76187: Improper Authentication

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

CVE-2026-82310: Insufficient Session Expiration

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

PT-2026-93310

The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attackers to make a logged-in customer cancel their own active subscription through a crafted request they are tricked into making...

PT-2026-93776

Name of the Vulnerable Software and Affected Versions Jenkins GitLab Plugin versions prior to 1.2149.vcfc32c82b f7f Description The plugin caches the GitLab API client for alternative GitLab API token credentials using a cache key based solely on the credentials ID, failing to include the folder...