CVE-2026-74858 jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery

A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetchurl/fetchurls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack...

CVE-2026-74858

In jae-jae fetcher-mcp up to 0.3.9, the fetch_url/fetch_urls functions in the URL Validation component fail to validate the AWS metadata endpoint /latest/meta-data/iam/security-credentials/, enabling remote SSRF. CVSS 6.3 (Medium); no patch is available yet, and the project has not responded to t...

CVE-2026-71567 User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

CVE-2026-71567

CVE-2026-71567 affects openshift-metal3/fakefish , a tool used for provisioning bare-metal infrastructure. The vulnerability is a shell injection caused by unquoted shell variables being inserted into command lines and Kubernetes manifests. The primary attack vectors are the Image URL and BMC cre...

CVE-2026-71567 User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

EUVD-2026-60193

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

CVE-2026-71567 User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

MINI-53WM-6QG2-GXQP

Bulletin has no description...

CVE-2026-68457

A flaw was found in ksmbd in the Linux kernel. This vulnerability allows certain file system control FSCTL operations, specifically SETSPARSE, SETZERODATA, and SETCOMPRESSION, to use incorrect credentials. Consequently, these operations can bypass the security checks established when the file was...

CVE-2026-14564

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

CVE-2026-14564

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

EUVD-2026-60161

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

CVE-2026-14564 Sensitive Data Exposure in Innotim Software's Logsign SIEM

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

CVE-2026-14564 Sensitive Data Exposure in Innotim Software's Logsign SIEM

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

CVE-2026-74891

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

PYSEC-2026-3767

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

PYSEC-2026-3767

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74892

opensslencrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication...

PYSEC-2026-3977

opensslencrypt versions before 1.4.0 configure CORS with alloworigins set to wildcard and allowcredentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits them...

CVE-2026-74893 openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...