CVE-2026-55786 Flyto2 Core: Unauthenticated Command Execution via HTTP MCP `execute_module`

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards executemodule arguments to the module registry without the requireauth dependency used by the REST...

CVE-2026-54554

The FOG open-source cloning and imaging suite is vulnerable in versions prior to 1.5.10.1870 . The adInfo() endpoint in packages/web/lib/fog/fogpage.class.php can be accessed without an authenticated session via node=ipxe. This flaw allows a remote unauthenticated requester to obtain the FOG_AD_D...

EUVD-2026-101520

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-100413

The distributed storage system SeaweedFS versions 4.0.388 through 4.40 contain a vulnerability where the SFTP Helm chart embeds an unencrypted Ed25519 private host key in the sftp-secret.yaml template. Under specific configuration conditions—including sftp.enabled and sftp.enableAuth being true, ...

EUVD-2026-101519

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...

CVE-2026-100413 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...

CVE-2026-100413 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...

CVE-2026-79957 ServiceNext Insecure Direct Object Reference via GetUsarios

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-79957

The ServiceNext application contains an Insecure Direct Object Reference (IDOR) vulnerability within the /api/Usuario/GetUsuarios endpoint. The flaw occurs because the application accepts a user-controlled numeric ID in the request body but fails to verify if the authenticated token belongs to th...

EUVD-2026-101517

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-79957 ServiceNext Insecure Direct Object Reference via GetUsarios

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

EUVD-2026-101514

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...