CVE-2026-51995

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

Red Hat: CVE-2026-77874: org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124498)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124498 advisory. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Tenable has extracted the preceding...

CVE-2026-86860: Missing Authorization

ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation. ServiceNow...

PT-2026-97777

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3 Description A missing authorization issue exists in the Task Group APIs. The affected APIs fail to properly verify if an authenticated user possesses the necessary permissions to access the proje...

PT-2026-97794

Name of the Vulnerable Software and Affected Versions UlakPDF versions through 09092026 Description An incorrect authorization issue in TÜBİTAK ULAKBİM UlakPDF allows for privilege escalation, which occurs when the system fails to properly verify if a user has the necessary permissions to perform...

PT-2026-97917

Name of the Vulnerable Software and Affected Versions Termix versions 1.8.0 through 2.5.0 Description Authenticated users can access the server-stats API without per-host authorization, failing to preserve tenant isolation. The affected routes in src/backend/ssh/server-stats.ts allow users to vie...

PT-2026-97823

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.32 through 0.1.38 Description A remote attacker can obtain sensitive information, including internal configuration and values, by triggering metadata processing. The issue resides in the authorization server...

CVE-2026-51995

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

PT-2026-97859

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1 Description An authorization bypass exists in the shovel management resour...

CVE-2026-87739: Authorization Bypass Through User-Controlled Key

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CVE-2026-97368: Authorization Bypass Through User-Controlled Key

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-86857: Missing Authorization

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access,...

CVE-2026-81473: Improper Authentication

Dell Rugged Control Center RCC, versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-85491: Incomplete Comparison with Missing Factors

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...

CVE-2026-85496: Generation of Predictable Numbers or Identifiers

The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session...

CVE-2026-61604: Improper Authorization

The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected...

CVE-2026-92529: Incorrect Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for...

CVE-2026-88847: Missing Authorization

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to...

CVE-2026-82849: Authorization Bypass Through User-Controlled Key

The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is...