CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

CVE-2026-55463

The Goobi viewer web application (versions 4.11.0 to before 26.05 ) is vulnerable to authentication and origin validation bypasses in its goobi-viewer-core component. Specifically, several Jakarta WebSocket endpoints (DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, and UserEndpoint)...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

CVE-2026-55463 Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 4.11.0 to before version 26.05, several Jakarta WebSocket endpoints in goobi-viewer-core DownloadTaskEndpoint, CampaignEndpoint, AutocompleteEndpoint, UserEndpoint accept connection...

EUVD-2026-109063

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-55459

The Goobi viewer web application (versions 25.01 to before 26.05 ) contains an authentication vulnerability in AuthenticationEndpoint.verifyOpenIdToken. The application fails to enforce the aud claim during cryptographic validation when building the JWT verifier. Instead, it performs a manual str...

CVE-2026-55459 Goobi viewer: OpenID JWT audience not enforced by the verifier

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version 26.05, AuthenticationEndpoint.verifyOpenIdToken builds its verifier as JWT.requirealgorithm.withIssuerissuer.build and does not enforce the aud claim during...

CVE-2026-57207 NetBox MCP Server: HTTP transport exposes all NetBox data without authentication

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox too...

CVE-2026-57207

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox too...

CVE-2026-57207

The NetBox MCP Server (prior to version 1.2.1 ) contains a vulnerability where the HTTP transport (when TRANSPORT=http is used) lacks authentication on the HTTP endpoint. This allows any client capable of reaching the port to establish a valid MCP session and gain full access to all four NetBox t...

EUVD-2026-108990

Missing authentication for a critical function in the Android Debug Bridge daemon adbd in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell uid 2000, a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 no...

CVE-2026-93629 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

CVE-2026-93629 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REQUEST Organizer Identity

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

EUVD-2026-108965

An organizer authentication vulnerability in Zimbra Collaboration Suite ZCS allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path permits external invitations but does not verify that the message sender is authorized to use the...

CVE-2026-93629

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in calendar processing. An unauthenticated email sender can insert calendar invitations attributed to another user by exploiting a lack of verification for the iCalendar ORGANIZER identity...

CVE-2026-93628 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-93628 Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar REPLY Attendee Response

An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite ZCS allows an unauthenticated sender to forge another attendee's response to an existing meeting. Zimbra passes a null sender identity when processing iCalendar REPLY components, causing the...

CVE-2026-93628

The Zimbra Collaboration Suite (ZCS) version 10.1.16 and 10.1.21 are vulnerable to an authentication bypass in the email calendar processing. The root cause is that the system passes a null sender identity when processing iCalendar REPLY components, which leads to the attendee authorization filte...