CVE-2026-80049

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

sudowp-postgallery

SudoWP PostGallery Fork de Segurança Contribuidores: SudoWP, WP Republic Autores Originais: RTO GmbH Tags: galeria, segurança, corrigido, cve-2025-13543 Requer pelo menos: 5.8 Testado até: 6.7 Tag estável: 1.12.6 Licença: GPLv2 ou posterior Aviso de Segurança Este é um fork endurecido contra...

cve-2021-41773-exploration

Panoramica CVE-2021-41773 è una vulnerabilità di path traversal scoperta in Apache HTTP Server 2.4.49 nell'ottobre 2021. La causa principale è stata un errore nella normalizzazione delle sequenze di punti finali nell'URL prima di verificare che il percorso richiesto rimanesse all'interno della ro...

keyguard

keyguard Scansiona codebase, progetti GCP e pipeline CI per credenziali API di Google esposte — prima che vengano sfruttate. Il problema: Google ha abilitato retroattivamente l'accesso all'API Gemini su chiavi API esistenti Maps, Places, ecc. progettate per essere pubbliche e incorporate nel codi...

WordPress Gutenverse plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Blocks vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Gutenverse versions = 4.0.2...

OptixGate

Optix Gate è uno strumento multiuso di amministrazione remota sicura per Microsoft Windows. Fornisce accesso remoto a più sessioni Windows e/o macchine contemporaneamente. Storia Optix Gate è stato creato, tra le altre cose, per mantenere e sviluppare ulteriormente le mie capacità di programmazio...

GHSA-72F3-6W86-7RV3 @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

Summary The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards the route, so any network-reachable client can issue an unauthenticated initialize request and obtain...

EUVD-2026-42717

@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint...

CVE-2026-71518

CVE-2026-71518 — Bypass dell'autorizzazione senza autenticazione in Typemill Le varianti URL equivalenti a livello di percorso aggirano i download dei media limitati per ruolo La restrizione è basata sul percorso grezzo della richiesta; il file viene letto dal percorso risolto dal sistema operati...

EUVD-2026-65701

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

EUVD-2026-65700

In Dradis Community Edition, the ProvidersController and AgentsController gate their adminrequired beforeaction on defined?Dradis::Pro, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated non-admin user can create an AI provider...

CVE-2026-61555 OpenEXR: Empty multiView viewFromChannelName file crash

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 are vulnerable to crashing. This occurs when Imf::GetChannelsInMultiPartFile processes a...

CVE-2026-76198

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

GHSA-CMWV-WF9P-P8WX genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled Host and Origin headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request,...

CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

EUVD-2026-65692

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

gardyn

Riepilogo A febbraio 2025 ho condotto una ricerca di sicurezza su un dispositivo Gardyn Home 4.0. Durante la mia ricerca, ho scoperto molteplici vulnerabilità e pratiche di sicurezza scadenti. Sfruttando queste vulnerabilità, un aggressore potrebbe ottenere accesso a livello di sistema a un...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion vulnerability

Authenticated Administrator+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Manager versions = 7.3.7.4...