https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 22:19:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339149 EUVD-2026-339149 https://cve.radiocsirt.org/vuln/euvd-2026-339149 https://cve.radiocsirt.org/vuln/fkie_cve-2026-10130 <p>QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim&#39;s identity without requiring any prior credentials or user interaction.</p> <p>QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim&#39;s identity without requiring any prior credentials or user interaction.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-10130 https://cve.radiocsirt.org/vuln/ghsa-hxxv-mxpg-3h6j <p>QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim&#39;s identity without requiring any prior credentials or user interaction.</p> <p>QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, causing the server to return a valid authenticated session token for the victim&#39;s identity without requiring any prior credentials or user interaction.</p> https://cve.radiocsirt.org/vuln/ghsa-hxxv-mxpg-3h6j