62133 matches found
CVE-2026-14541
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...
GHSA-5P9G-J988-PCWV
creationtimestamp| type| source ---|---|--- 2026-07-31 02:31:09+00:00| seen| https://gist.github.com/alon710/eb7bbb63a594430d7d6ab18e1b915ebd...
CVE-2026-6890
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
GHSA-MMJF-RQRV-855V vulnerabilities
Vulnerabilities for packages: promitor, dotnet-bootstrap...
GHSA-64M9-QG9M-54W5 vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-HVRP-RF83-W775 vulnerabilities
Vulnerabilities for packages: semgrep...
CVE-2026-14541
The CVE concerns Google mcp-toolbox version 1.4.0 in its Google OAuth provider component. If an authService is initialized with mcpEnabled: true but without an explicit audience or clientId, the ValidateMCPAuth pipeline for opaque tokens omits audience validation. This causes the toolbox to accep...
SUSE CVE-2026-4286
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to check if teamid was being changed when updating playbooks, allowing users with only Manage Playbook Configurations permission to change a playbook's team, bypassing manage members restriction via PUT api. Mattermost Advisory ID:...
SUSE CVE-2026-6970
authd prior to version 0.6.4 contains a logic error in primary group ID assignment that can lead to local privilege escalation. When a user's primary group ID GID differs from their UID, either because the account was created with authd prior to version 0.5.4 or because the primary group was...
ECHO-0EA6-9825-F478
Bulletin has no description...
OPENSUSE-SU-2026:11410-1 cf-cli-8.18.4+git.0.3fcd823a1-1.1 on GA media
These are all security issues fixed in the cf-cli-8.18.4+git.0.3fcd823a1-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2025-69948: Improper Neutralization of Special Elements used in an SQL Command
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...
CVE-2026-61893
The CVE-2026-61893 entry concerns the MZ Automation lib60870 library. A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer, indicating an out-of-bounds read in...
ECHO-81DC-CE3A-8510
Bulletin has no description...
ECHO-96FB-2D4B-2D17
Bulletin has no description...
ECHO-84D4-4C4E-BD16
Bulletin has no description...
ECHO-9C14-687D-5BF7
Bulletin has no description...
ECHO-C3E5-5E37-B99F
Bulletin has no description...