CVE-2026-9561

CVE-2026-9561 affects Eclipse Kura before 5.6.2. The Web Console (org.eclipse.kura.web2) and REST API (org.eclipse.kura.rest.provider) trust the client-controlled X-Forwarded-For header as the primary source for client IP in audit contexts, and Jetty’s ForwardedRequestCustomizer is installed on a...

free (>=0.0.1, <=0.0.2), hdltex (1.0.4) +2 more potentially affected by CVE-2026-12482 via keras (2.0.9)

keras PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - free =0.0.1, =1.0.0, =1.0.1, =1.0.2 Source cves: CVE-2026-12482 Source advisory: OSV:GHSA-58HV-7753-XMFQ...

GHSA-V8HX-4VX8-WC96 Kimai: Pre-2FA KIMAI_SESSION cookie grants full authenticated REST API access, bypassing TOTP

Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAISESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submitting...

PT-2026-60094

Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAI SESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submittin...

PT-2026-58994

Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAI SESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submittin...

CVE-2026-58319: Missing Authentication for Critical Function

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to...

CVE-2026-15389: Authorization Bypass Through User-Controlled Key

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier USID as the sole validation mechanism, without verifying whether that...

CVE-2026-9561: Use of Less Trusted Source

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP address in audit log entries. The org.eclipse.kura.web2 Web Console and org.eclipse.kura.rest.provider REST API components use this header as the primary IP sour...

aiograpi-rest (>=1.0.0, <=5.15.2) potentially affected by CVE-2026-47157 via aiograpi (0.9.7)

aiograpi PYPI version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiograpi and may be impacted: - aiograpi-rest =1.0.0, =5.15.2 Source cves: CVE-2026-47157 Source advisory: OSV:PYSEC-2026-2337...

PYSEC-2026-2660 MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...

MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...

PYSEC-2026-2682 Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Impact A stored Cross-Site Scripting XSS vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls single click interaction. T...

Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

ImpactA stored Cross-Site Scripting XSS vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls single click interaction.The...

beetcamp (>=0.18.0, <=0.19.3), beets-extended-metadata (0.1.9) +4 more potentially affected by CVE-2026-42052 via beets (1.6.0)

beets PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on beets and may be impacted: - beetcamp =0.18.0, =0.3.1, =0.2.0, =0.3.24, =0.4.0 Source cves: CVE-2026-42052 Source advisory: OSV:PYSEC-2026-2397...

PYSEC-2026-2507 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

Summary The ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional co...

aether (>=0.3.26, <=0.3.32), animalai-train (>=0.4.2, <=0.5.0) +26 more potentially affected by CVE-2022-35974 via tensorflow (1.12.0)

tensorflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - aether =0.3.26, =0.4.2, =1.0.17.1, =0.1.0, =0.3.1, =0.1.0, =0.0.1, =1.0.0, =0.7.0, =0.8.0 and more Source cves: CVE-2022-35974 Source...

Improper Handling of URL Encoding (Hex Encoding)

Overview Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding in the MCP REST client due to improper encoding of user-supplied identifiers during f-string URL construction. An attacker can access unintended API endpoints by injecting crafted path...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...

CVE-2026-41041 Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...