high One link deanonymizes a crypto exchange user

Avatar Upload Turned Into Stored XSS Steals Exchange Users' Identity Data

An unsigned upload content type plus a wildcard cross-origin policy let one link read a crypto exchange user's identity, verification status, and wallet address on a single click.

Jun 19, 2026
WebStored XSSCORS
high Name-only sandbox yields in-pod command execution

Script Sandbox Escape Leaks a Persistent Production API Key

A simulation platform's script sandbox blocked modules by name only, letting any user run commands in the production worker pod and steal a long-lived API key.

Jun 18, 2026
APISandbox EscapeCode Execution
high No-login profile API hands over accounts

Unauthenticated Profile API Allows Account Takeover Across a Retail Group

A retail group's shared sign-in service exposed a profile API with no authentication and no ownership check, allowing full data reads or a login-credential overwrite given a user's internal id.

Jun 17, 2026
WebAuth BypassAccount Takeover
high Test parameter captures signup credentials

A Leftover Test Parameter Loads Attacker Code on a Real Signup Page

An unanchored host check let a leftover test parameter load attacker JavaScript on a trading platform's genuine signup page, swapping the form to capture credentials in cleartext.

Jun 17, 2026
WebReflected XSSCredential Theft
high One click yields permanent account takeover

One-Click Speaker-Linking Flow Hands Over a Streaming Account

A smart-speaker linking flow let an attacker steer a victim's one-click authorization into the attacker's device, harvest a write-capable token, and permanently take over the music account.

Jun 16, 2026
OAuthAccount TakeoverToken Theft
critical Full card data stolen from the real form

Card Skimmer Inside a Payment Provider's Own Card Form

A disabled origin check plus a CSS injection let any website embed a money-transfer provider's genuine card form and silently steal full card details from inside its own secure environment.

Jun 15, 2026
WebpostMessageCSS Injection
critical Any subscriber takeover, no password

Unauthenticated Account Takeover of Any Subscriber via a Forgeable Login Token

An unauthenticated token-minting chain let anyone log into a news subscription portal as any user knowing only a sequential account number, gaining full account control across multiple brands.

Jun 15, 2026
WebAuth BypassIDOR
high Millions of subscribers, no login

Unauthenticated Order Lookup Leaks Subscriber Data by Counting

An unauthenticated order-details endpoint with sequential order numbers exposed millions of news subscribers' contact details across multiple brands, harvestable straight from visitors' browsers.

Jun 15, 2026
WebIDORPII Exposure
high Free trial leaks production cloud credentials

A Free-Trial Search Feature Leaks Production Cloud Credentials

A data-source endpoint field with no host restrictions let any free-trial user force a production worker to leak live signed cloud credential headers and return internal content as search results.

Jun 12, 2026
APISSRFCloud
critical Arbitrary file read, served publicly

Photo Upload Reads Files Off the Production Servers

A crafted image uploaded to a fitness app's photo feature made the image-processing library read arbitrary files off production, with contents served back on a public image host.

Jun 11, 2026
WebLFIImageMagick