EUVD-2026-88214

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-81375

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-81375 Confused Deputy in Application Integration allows Internal File Read

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-81375

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-20516

CVE-2026-20516: MiracastService confused deputy on Android TV Research and disclosure by Davide Di Matteo @Dingo97. This is my first credited CVE. I found an improperly exported, system-privileged Miracast service while researching a PEAQ Android TV. A caller can supply an intent extra that makes...

CVE-2026-49086

camel-dapr Consumer Routing-Header Override / Confused Deputy Reproducer CVE-2026-49086 This project demonstrates a routing-header override confused-deputy flaw in Apache Camel's camel-dapr component, tracked as CVE-2026-49086. The Dapr pub/sub consumer DaprPubSubConsumer copies fields of the...

CVE-2026-72668

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668 Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

EUVD-2026-87792

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

CVE-2026-72668

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts...

EUVD-2026-87709

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

CVE-2026-100614 Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker

Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the...

PoC-in-GitHub

PoC in GitHub 2026 CVE-2026-0006 2026-03-02 In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-64640

CVE-2026-64640 — Apache Polaris: credential vending before location validation in register A self-contained, one-command reproducer for CVE-2026-64640 : the Iceberg REST register endpoints in Apache Polaris mint cloud storage credentials for a caller-supplied path and read that path server-side...

Kibana 9.4.7, 9.5.0 Security Update (ESA-2026-85)

Unintended Proxy or Intermediary 'Confused Deputy' in Kibana Leading to Privilege Escalation Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations...

Linux Distros Unpatched Vulnerability : CVE-2026-95361

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in DevTools. CVE-2026-95361 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Linux Distros Unpatched Vulnerability : CVE-2026-91742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system acce...

Linux Distros Unpatched Vulnerability : CVE-2026-95328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Confused deputy in Mobile. CVE-2026-95328 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue

Summary A critical Confused Deputy Arbitrary File Read & Exfiltration vulnerability in the Atlassian MCP server Python allows an AI agent to exfiltrate sensitive host files and environment secrets. By providing absolute system paths to the attachments parameter of the updateissue tool, an agent c...

CVE-2026-77255

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira updateissue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace validation. A caller can make the MCP serv...