CVE-2026-105131 debrief based on the supplied source corpus. The vulnerability is a privilege escalation issue in ezBookkeeping 1.2.0 before 2.0.1, allowing attackers with an API token to obtain a full session token via /api/v1/tokens/refresh.json. This happens because TokenRefreshHandler never checks token type, enabling attackers to exchange short-lived or IP-restricted API tokens for 30-day normal sess [truncated]
CVE-2026-94112 debrief based on the supplied source corpus. The CVE record was published on 2026-09-20T12:17:06.953Z and has not been modified since then. The vulnerability affects mayswind ezBookkeeping before version 2.0.0, allowing attackers to replay captured TOTP passcodes within the acceptance window. This could lead to unauthorized authentication and access. Defenders should assess exposure and pri [truncated]
