CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

CVE-2026-56764

A flaw was found in Hono. This vulnerability, a timing attack, exists in the basicAuth and bearerAuth middlewares due to a non-constant-time string comparison. A remote attacker could exploit the early termination of string equality checks to infer valid credentials by precisely measuring respons...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-67185

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-54603

OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect OIDC. From 0.4.0 to 2.0.21, a protocol-relative redirect Location returned to OAuth2::Clientrequest overrides the request authority, so the bearer Authorization header is sent to an...

CVE-2026-67185

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-54603

Summary (CVE-2026-54603) OAuth2 (Ruby) versions 0.4.0 through 2.0.21 leak credentials via protocol-relative redirects during the OAuth2::Client#request flow. When a 301/302/303/307 redirect’s Location header is protocol-relative (//host/...), the client’s base URL is overridden and the original A...

CVE-2026-7775

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

CVE-2026-7775 Cross-site Scripting Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

EUVD-2026-49887

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

CVE-2026-67178 Open Redirect in MISP Installer-Generated Apache Configuration

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...

GHSA-28F5-38XR-JH2W java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor

Summary When directConnecttrue is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEWSESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no...

Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

MAL-2026-11134 Malicious code in color-convert-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9 The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity hostname, whoami, id, sudo -...

Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...

Malicious code in xerohub-discord-voice-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 066cb7d27a71055b89630648ee5ae6eed64d6db93e883de66a5db678cfa7663c xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner flow covertly forwards the caller's...

MAL-2026-11125 Malicious code in api-rust-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 268179cffa6aef31ad248757e61fc892cb826bde059502b3e2c3a74277951e05 On npm install, the package's postinstall hook node test.js executes two payloads against the installer host. First, it fetches an attacker-controlle...

Sensitive Information Exposure

OpenClaw is vulnerable to Sensitive Information Exposure. The vulnerability is due to insufficient enforcement of credential redaction during trajectory exports, where lower-trust callers can exploit misconfigured input paths or feature access to expose sensitive credentials and other protected...

CVE-2026-13994

An inappropriate implementation flaw was found in the Credential Management component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514067416...