Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellat...

CVE-2026-49447

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as

历史摘要 · 未重新核验 · NVD

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

CVE-2026-49447

### Summary `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that s

历史摘要 · 未重新核验 · GitHub Advisory

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate t...

CVE-2026-54635

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.

历史摘要 · 未重新核验 · NVD

pytonapi has a Webhook Custom Path Authentication Bypass

CVE-2026-54635

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.

历史摘要 · 未重新核验 · OSV.dev

This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A person with physical access to a locke...

CVE-2026-64745

This issue was addressed with additional restrictions on the lock screen. This issue is fixed in macOS Sequoia 15.7.8, m

历史摘要 · 未重新核验 · NVD

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physica...

CVE-2026-43766

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS

历史摘要 · 未重新核验 · NVD

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyon...

CVE-2026-66014

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific condi

历史摘要 · 未重新核验 · NVD

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces r...

CVE-2026-9830

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission cal

历史摘要 · 未重新核验 · NVD

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify owne...

CVE-2026-14568

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration Wor

历史摘要 · 未重新核验 · NVD

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in t...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check alwa

历史摘要 · 未重新核验 · NVD

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated ...

CVE-2026-13332

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX acti

历史摘要 · 未重新核验 · NVD

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce ...

CVE-2026-12493

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved ext

历史摘要 · 未重新核验 · NVD

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled ...

CVE-2026-12255

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration reques

历史摘要 · 未重新核验 · NVD

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

## Preface Poweradmin maps OIDC identities into local users through `oidc_user_links.oidc_subject` plus `provider_id`.

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

### Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account **by email address

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal session_id query injection)

CVE-2026-59224

## Summary The terminal proxy in `backend/open_webui/routers/terminals.py` forwards the Open WebUI user's identity to t

历史摘要 · 未重新核验 · GitHub Advisory

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform...

CVE-2026-56191

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network

历史摘要 · 未重新核验 · GitHub Advisory

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges...

CVE-2026-62825

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

历史摘要 · 未重新核验 · GitHub Advisory

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass...

CVE-2026-15981

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, a

历史摘要 · 未重新核验 · GitHub Advisory

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit...

CVE-2026-10697

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5,

历史摘要 · 未重新核验 · GitHub Advisory