CVE-2026-78223

AshAuthentication (team-alembic, Elixir) suffers from an improper cryptographic signature verification in its token revocation flow. The function RevokeTokenChange.change/3 decodes the incoming token via Joken.peek_claims/1 without verifying its signature, then writes the jti, exp, and sub claims...

CVE-2026-86522

AshAuthentication (team-alembic, Elixir/Phoenix) contains a log injection flaw in AshAuthentication.Strategy.Password.RequestPasswordReset.run/3. The identity argument—supplied directly from the password-reset request—is interpolated into Logger.warning/1 heredocs without escaping, truncating, or...

CVE-2026-81637

CVE-2026-81637 is an insufficient session expiration flaw in AshAuthentication (team-alembic, Elixir ecosystem). In AshAuthentication.Strategy.OAuth2.Plug.callback/2, the OAuth2 CSRF state (session_params) is deleted via a rebind inside a with chain, but Elixir's else-block scoping causes every f...

CVE-2026-82761

AshAuthentication (by team-alembic) is vulnerable to a TOCTOU race condition that allows concurrent redemptions of a single-use magic link token. The sign-in flow verifies the JWT via Jwt.verify/4 and revokes it only in an after_action or after_transaction hook, after the sign-in has already comm...

CVE-2026-82685

AshAuthentication (ash_authentication library by team-alembic) suffers from an Authorization Bypass Through User-Controlled Key in AddOn.Confirmation.ConfirmChange. The function verifies the token's signature and act claim but never compares the sub claim against changeset.data, so a confirmation...

CVE-2026-82760

AshAuthentication (Elixir library by team-alembic) is vulnerable to CPU and memory exhaustion via superlinear base62 decoding in the API key sign-in flow. The root cause is in AshAuthentication.Base.decode62/1, which recomputes Integer.pow(62, index) at every character position instead of accumul...

CVE-2026-82759

AshAuthentication (team-alembic), an Elixir authentication library, contains a vulnerability in its audit log IP privacy mode. The function IpPrivacy.hash_ip/1 computes an unkeyed SHA-256 hash using a salt that falls back to the publicly known constant "default-salt-change-in-production". Because...

CVE-2026-82723

AshAuthentication (the Elixir authentication library by team-alembic) stores full actor records—including the hashed_password attribute—into audit log entries via the audit_log add-on's build_extra_data/4 function. The :actor value from the action callback context is deposited verbatim, bypassing...

CVE-2026-92904

CVE-2026-92904 is a flaw in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves a job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job...

CVE-2026-92932

CVE-2026-92932 affects the MISP sachertortephp library, specifically the Xml::build() static method in lib/Cake/Utility/Xml.php. The root cause is a PHP operator precedence error : the condition $options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0 evaluates ...

CVE-2026-92921

admin3 (versions through 3.0.0 ) stores account passwords using single-round MD5 with only the username as salt and no key derivation function, as seen in its SecurityUtil.java and UserCredential.java source files. Because MD5 is computationally inexpensive, an attacker with database access can r...

CVE-2026-92920

admin3 (a Java-based admin framework) through 3.0.0 fails to invalidate existing sessions when a user account is disabled. The root cause lies in the AuthInterceptor , which never re-validates a user's locked status, and the LocalSessionManager , which resets session expiry on each request. As a ...

CVE-2026-92918

admin3 through 3.0.0 discloses user session tokens in the audit log event body when publishing UserLoggedIn domain events. The root cause is that DefaultSessionService persists the session token into the log entry, making it retrievable via the GET /logs endpoint by any user with log:view permiss...

CVE-2026-92919

admin3 versions through 3.0.0 are affected by an arbitrary file write vulnerability in the storage upload handler . The application fails to sanitize client-supplied filenames, allowing authenticated (low-privilege) users to inject dot-dot path traversal segments that escape the configured storag...

CVE-2026-81481

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain a Path Traversal vulnerability (improper limitation of a pathname to a restricted directory). An unauthenticated attacker with remote access could exploit this to gain filesystem access , with a HIGH confidentiality impact bu...

CVE-2026-81480

Dell OpenManage Server Administrator (OMSA) , versions prior to 11.1.0.3 , contains a Stack-based Buffer Overflow vulnerability. A high-privileged attacker with remote network access can potentially exploit it to achieve code execution , resulting in high impact to confidentiality, integrity, and...

CVE-2026-92860

CVE-2026-92860 affects rcourtman Pulse versions up to 6.0.4/6.1.0-rc.4 . The vulnerability resides in the Quick Security Setup Handler component, specifically the fmt.Sprintf function within /api/security/quick-setup. Manipulating the Username argument triggers improper input validation , enablin...

CVE-2026-90823

FatPipe MPVPN, WARP, and IPVPN appliances running end-of-life firmware 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker who can reach the management interface can submit a crafted authentication request that triggers an unchecked ...

CVE-2026-90822

CVE-2026-90822 affects FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware 10.1.2r60p100 . An OS command injection in the xtremed daemon allows an unauthenticated remote attacker to submit crafted input to the AuthFormServlet endpoint on the management interface, causing au...

CVE-2026-81441

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with local access could exploit this flaw to cause a Denial of Service . The CVSS 3.1 base score is 4.0 (MEDIUM) (AV:L/AC:L/PR:N/UI:N/S...