PT-2026-44034

When creating an export through the pretix API, API clients are returned an UUID value for their export job a long, random string like 35742818-c375-4d15-839f-d49aecce94d6. Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places...

GHSA-6H4J-WCR9-2VG7 n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints

Impact The OAuth1 and OAuth2 credential reconnect endpoints authorized access using credential:read rather than credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow and overwrite the stored token material for that credential...

Do Coding Agents Understand Least-Privilege Authorization?

As coding agents gain access to shells, repositories, and user files, least-privilege authorization becomes a prerequisite for safe deployment: an agent should receive enough authority to complete the task, without unnecessary authority that exposes sensitive surfaces.To study whether current...

CVE-2026-31956 Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of th...

CVE-2026-3737 SourceCodester Pet Grooming Management Software User Creation add_user.php improper authorization

A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file adduser.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has bee...

CVE-2023-49261

The "tokenKey" value used in user authorization is visible in the HTML source of the login page...

CVE-2022-0919

The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number ...

EUVD-2016-0355

Malware in sbrugna...

EUVD-2016-6367

Malware in sbrugna...

EUVD-2021-10001

Malware in sbrugna...

EUVD-2018-14349

Malware in sbrugna...

EUVD-2019-17902

Malware in sbrugna...

EUVD-2019-0145

Malware in sbrugna...

EUVD-2019-9478

Malware in sbrugna...

EUVD-2021-10285

Malware in sbrugna...

EUVD-2018-17258

Malware in sbrugna...

EUVD-2019-17892

Malware in sbrugna...

EUVD-2017-14076

Malware in sbrugna...

EUVD-2019-0402

Malware in sbrugna...

EUVD-2011-1385

Malware in sbrugna...