CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554 FOG adInfo endpoint is reported to disclose the Active Directory join password

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-54554

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-100413

The distributed storage system SeaweedFS versions 4.0.388 through 4.40 contain a vulnerability where the SFTP Helm chart embeds an unencrypted Ed25519 private host key in the sftp-secret.yaml template. Under specific configuration conditions—including sftp.enabled and sftp.enableAuth being true, ...

EUVD-2026-101519

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...

CVE-2026-100413 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...

CVE-2026-100413 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...

CVE-2026-79957 ServiceNext Insecure Direct Object Reference via GetUsarios

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-79957

The ServiceNext application contains an Insecure Direct Object Reference (IDOR) vulnerability within the /api/Usuario/GetUsuarios endpoint. The flaw occurs because the application accepts a user-controlled numeric ID in the request body but fails to verify if the authenticated token belongs to th...

EUVD-2026-101517

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-79957 ServiceNext Insecure Direct Object Reference via GetUsarios

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

EUVD-2026-101514

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is vulnerable to a memory exhaustion Denial of Service (DoS) in versions before 1.29.1 and from 2.0.0a1 through 2.0.1 . The vulnerability exists because the Streamable HTTP session manager , SSE message endpoint , and OAuth authorization-server routes buffer ...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-86856

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption...