Adobe Connect Desktop Application Privilege Escalation

The vulnerability of the Adobe Connect Desktop Application’s instant messaging feature is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Adobe Connect Instant Messaging Code Execution

The vulnerability of the Adobe Connect Desktop Application’s instant messaging function is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

IBM App Connect Enterprise Information Disclosure (7272270)

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenabl...

CVE-2026-44428

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher...

CVE-2026-44428

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher...

CVE-2026-44428

The CVE-2026-44428 issue affects the MCP Registry’s GitHub OIDC token flow: before 1.7.6, both client and server validate a shared audience string (audience=mcp-registry) across registry deployments, enabling a token obtained for one registry to be replayed against another. This breaks deployment...

CVE-2026-44428 MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher...

WS-2021-0333

Linux Kernel in versions from v5.4.112 to before v5.4.119 contains a use-after-free vulnerability at llcpsockbind/connect...

CVE-2026-44501

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend datahub-frontend-react deserializes attacker-controlled Java objects from the REDIRECTURL HTTP cookie during the OIDC callback flow, with no integrity protection no HMAC, no encryption. This is a Deserialization o...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to axios

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to axios. Vulnerability Details CVEID:CVE-2026-42033 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior...

EUVD-2026-30321

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend datahub-frontend-react deserializes attacker-controlled Java objects from the REDIRECTURL HTTP cookie during the OIDC callback flow, with no integrity protection no HMAC, no encryption. This is a Deserialization o...

CVE-2026-44501 DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend datahub-frontend-react deserializes attacker-controlled Java objects from the REDIRECTURL HTTP cookie during the OIDC callback flow, with no integrity protection no HMAC, no encryption. This is a Deserialization o...

CVE-2026-44501

DataHub frontend (datahub-frontend-react) prior to 1.5.0.3 deserializes attacker-controlled Java objects from the REDIRECT_URL cookie during the OIDC callback (GET /callback/oidc) with no integrity protection. This CWE-502 Deserialization of Untrusted Data vulnerability requires a valid user acco...

CVE-2026-44501 DataHub OIDC REDIRECT_URL Cookie Deserialization Vulnerability

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend datahub-frontend-react deserializes attacker-controlled Java objects from the REDIRECTURL HTTP cookie during the OIDC callback flow, with no integrity protection no HMAC, no encryption. This is a Deserialization o...

@cameronhunter/jest-json-schema (2.1.0), @limedocs/core (>=1.0.0-beta.1, <=1.0.0-beta.13) +3 more potentially affected by unknown CVE via url-relative (1.0.0)

url-relative NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on url-relative and may be impacted: - @cameronhunter/jest-json-schema 2.1.0 - @limedocs/core =1.0.0-beta.1, =0.9.0, =0.16.16 Source cves: unknown CVE Source advisory:...

anvil-connect (>=0.1.24, <=0.1.36), anvil-connect-jwt (0.1.2) potentially affected by unknown CVE via jsjws (0.7.7)

jsjws NPM version 0.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on jsjws and may be impacted: - anvil-connect =0.1.24, =0.1.36 - anvil-connect-jwt 0.1.2 Source cves: unknown CVE Source advisory: MEND:WS-2016-0074...

anvil-connect (>=0.1.24, <=0.1.36), anvil-connect-jwt (0.1.2) potentially affected by unknown CVE via jsjws (0.7.7)

jsjws NPM version 0.7.7 is affected by a known vulnerability. The following packages have a transitive dependency on jsjws and may be impacted: - anvil-connect =0.1.24, =0.1.36 - anvil-connect-jwt 0.1.2 Source cves: unknown CVE Source advisory: MEND:WS-2015-0048...

PT-2026-40949

DataHub is an open-source metadata platform. Prior to 1.5.0.3, The DataHub frontend datahub-frontend-react deserializes attacker-controlled Java objects from the REDIRECT URL HTTP cookie during the OIDC callback flow, with no integrity protection no HMAC, no encryption. This is a Deserialization ...

PT-2026-61365

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SMC-D client where the system fails to properly validate the ism dev slot when processing a CHID-0 ACCEPT. Specifically, the smc v2 determine accepted chid functio...

MCP Registry code-related vulnerabilities

MCP Registry is an open-source MCP server application store developed by Model Context Protocol. Versions of MCP Registry prior to 1.7.6 contained code-related vulnerabilities. These vulnerabilities stemmed from the OIDC process on both the client and server sides being tied only to a global...