A wildcard browser message target on a consumer review platform's login popup leaked the authorization code to any cross-origin page, allowing a one-click silent email rebind and permanent business account takeover.
May 19, 2026An unauthenticated retrieve-quote endpoint accepted candidate quote numbers and returned full customer PII for valid ones, with no challenge and no rate limit, across five sibling insurance brands.
May 18, 2026An auth-bypass flag on a home-insurance retrieve endpoint exposed full customer dossiers including saved card data, mortgagee banks, and direct-debit bank details, with no authentication.
May 17, 2026An insurer's message-centre endpoint converted any Australian mobile number into the matching customer's full identifiable record, with no authentication, across five sibling brands.
May 17, 2026A persistent injection into a news site's password-reset email captured the victim's brand-new plaintext password and session cookies the moment they clicked a genuine reset link from the publication itself.
May 15, 2026A path field in a managed streaming connector reflected raw worker file contents back through status and logs, leaking the worker TLS private key to read-only project members.
May 15, 2026A signing key recovered offline from a news publication's Android app let any browser forge a subscriber session token, unlocking every paywalled article with no account and no payment.
May 14, 2026A consumer review platform's business dashboard imported from an unclaimed internal package scope on the public registry, leaving the door open to a supply-chain hijack of every business customer.
May 14, 2026Two interactive data-explorer apps on a national clinical-outcomes registry skipped session validation, exposing tens of thousands of patient records with 149 clinical variables to any internet visitor.
May 13, 2026An SVG upload stored verbatim with no content-security policy let a single link click capture a company manager's session token and unlock 320 confidential reports across two programs.
May 13, 2026