Improper Access Control

mcppinotserver is vulnerable to Improper Access Control. The vulnerability is due to the MCP server defaulting to an unauthenticated HTTP service bound to 0.0.0.0:8080, which allows an attacker on the network to access MCP tools and exploit the server's Pinot credentials to execute unauthorized S...

CVE-2026-56423

creationtimestamp| type| source ---|---|--- 2026-06-27 11:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpbemkubda2h 2026-07-13 22:00:06+00:00| seen| https://t.me/GithubRedTeam/92758 2026-07-14 00:00:09+00:00| seen| https://t.me/GithubRedTeam/92758 2026-07-15 00:00:36+00:00|...

CVE-2026-11773

creationtimestamp| type| source ---|---|--- 2026-06-27 10:20:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpbadz2g3w27 2026-06-27 19:16:17+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpc6bnt63z2r...

Authorization Bypass

Apache Camel is vulnerable to Authorization Bypass. The vulnerability is due to insufficient validation of user-controlled Build resources, which allows an authorized attacker to generate Pods in arbitrary Kubernetes namespaces, including the operator namespace...

GHSA-V23M-CCFG-PQ9H

creationtimestamp| type| source ---|---|--- 2026-06-27 07:12:30+00:00| seen| https://gist.github.com/alon710/df5b0744014030db937f68dddaa36b9f...

CVE-2026-12415

creationtimestamp| type| source ---|---|--- 2026-06-27 06:00:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mparsjsyrw2u 2026-06-27 06:18:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpassotsjd2s 2026-06-27 06:25:12+00:00| seen|...

CVE-2026-11356

creationtimestamp| type| source ---|---|--- 2026-06-27 05:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mparafvfd52d 2026-06-27 06:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpasolpaii2i 2026-06-29 19:25:55+00:00| seen|...

GHSA-WW5P-J6CJ-6MQQ

creationtimestamp| type| source ---|---|--- 2026-06-27 05:12:34+00:00| seen| https://gist.github.com/alon710/50034d243d8ecc5094ce95388ae028b5...

SUSE CVE-2026-52979

In the Linux kernel, the following vulnerability has been resolved: net: psp: check for device unregister when creating assoc pspassocdevicegetlocked obtains a pspdev reference via pspdevgetforsock which uses pspdevtryget under RCU; it then acquires psd-lock and drops the reference. Before the lo...

CVE-2026-13422

The HD Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.2.0 to 2.2.1. This is due to missing or incorrect nonce validation on the hdqvalidatenonce function. This makes it possible for unauthenticated attackers to delete or modify quizzes and questions, create ne...

CVE-2026-13422

The CVE concerns the WordPress plugin HD Quiz (WordPress) versions 2.2.0–2.2.1. The root cause is missing or incorrect nonce validation in the hdq_validate_nonce function, enabling Cross-Site Request Forgery. This allows unauthenticated attackers to delete or modify quizzes and questions, create ...

GHSA-QRV3-253H-G69C

creationtimestamp| type| source ---|---|--- 2026-06-27 00:42:18+00:00| seen| https://gist.github.com/alon710/ce97a7a2201a10b1242cd90e0ea16a7d...

EUVD-2026-39926

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command...

CVE-2024-23581

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7ywxayrf2x 2026-06-29 14:40:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgpsovehl2w 2026-06-29 14:40:43+00:00| seen|...

CVE-2026-46604

creationtimestamp| type| source ---|---|--- 2026-06-26 21:50:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7wh7n3cg2m 2026-06-29 14:45:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgq3cj5ah2o...

GHSA-985R-Q3QP-299H

creationtimestamp| type| source ---|---|--- 2026-06-26 21:42:10+00:00| seen| https://gist.github.com/alon710/e9c21cf2a4b3d2c5f2db0a4799f8c878 2026-07-14 01:00:05+00:00| seen| https://t.me/bdufstecru/3261 2026-07-15 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3261...

Malicious code in db-rake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a0d966d760dca0783a79eb150639ccfaf01aac944481e793dbcb7d7669983c When a consumer imports db-rake and constructs any Model, the package's resetor method silently runs npm install db-dx-connector unpinned, no-save:...

CVE-2026-54188

creationtimestamp| type| source ---|---|--- 2026-06-26 20:29:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp7rux6h2u2b...

UBUNTU-CVE-2026-53324

In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pciname for debugfs directory naming Use pcinamepdev for the per-device debugfs directory instead of hardcoded "0" for PFs and pcislotnamepdev-slot for VFs. The previous approach had two issues: 1. pcislotname...

GHSA-4C8J-MGM4-QQVP

creationtimestamp| type| source ---|---|--- 2026-06-26 19:42:06+00:00| seen| https://gist.github.com/alon710/89044faa74c1d9de479703a9098fa939 2026-07-29 08:01:20+00:00| seen| https://t.me/nxblog/1745 2026-07-30 00:02:09+00:00| seen| https://t.me/nxblog/1745 2026-08-01 20:00:05+00:00| seen|...