EUVD-2026-50563

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion Unbounded Map Growth...

CVE-2026-53431 Boruta accepts expired JWT client assertions due to missing exp claim validation

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after the assertion has expired. Boruta accepts JWT-based client authentication clientsecretjwt and...

CVE-2026-53431

Boruta (malach-it) Authentication Bypass via Capture-replay: from 2.3.0 before 2.3.7, JWT client assertions can be replayed after expiry because exp is not validated. Root causes: check_expiration only verifies presence of exp; token_config returns an empty map, so Joken’s exp validator is not en...

CVE-2026-65635

Improper Isolation or Compartmentalization vulnerability in malach-it boruta Elixir.Boruta.Openid module allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.registerclient/3 forwards caller-supplied...

CVE-2026-12722

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2...

CVE-2026-11980

The CVE-2026-11980 entry affects IBM Aspera Desktop App versions 1.0.5 through 1.0.19. The issue allows arbitrary code execution by loading DLL files at startup, stemming from Use of Inherently Dangerous Function (CWE-242). Impact is high (Local with user interaction required, per CVSS: 3.1, AV:L...

EUVD-2026-51136

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

Malicious code in @wbnr/design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username from USER/USERNAME environment variabl...

MAL-2026-11196 Malicious code in @wbnr/design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username from USER/USERNAME environment variabl...

CVE-2026-5219

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...

CVE-2026-12722 Authentication Bypass in FTC Software's E-Commerce Management Panel

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2...

CVE-2026-12722 Authentication Bypass in FTC Software's E-Commerce Management Panel

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2...

EUVD-2026-51109

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2...

CVE-2026-54365 CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

CVE-2026-5582

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

CVE-2026-5582

The FuseWP WordPress plugin (versions up to 1.1.24.2) is affected by a Cross-Site Request Forgery due to missing nonce verification in the toggle_sync_status() function. This enables unauthenticated attackers to toggle the status of sync rules (enable/disable) by luring a site administrator to pe...

CVE-2026-64785

A flaw was found in SwiftNIO HTTP/2. This vulnerability allows a remote attacker to perform HTTP request smuggling or response splitting. The issue stems from insufficient validation of incoming HTTP/2 HEADERS frames, which are parts of an HTTP/2 request. This allows special control characters,...

CVE-2026-7260

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...