CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787 An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85787

CVE-2026-85787 affects the SQL validation component of Amazon awslabs postgres-mcp-server (versions before 1.1.7 ). Due to an incomplete list of disallowed inputs , an unauthenticated actor can place crafted SQL into content submitted when an authenticated user interacts with the MCP server, enab...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85540

DreamMaker , a product developed by Interinfo , is affected by a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. The vulnerability is rated HIGH with a CVSS v3.1 base score of 8.8 (network vector, low com...

kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with OTRUNC truncate and ORDONLY read-only flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having...

PT-2026-86254

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

CVE-2026-85547: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85787: Incomplete List of Disallowed Inputs

An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthenticated actor to modify data beyond the read-only scope by placing crafted SQL into the content that is submitted when an authenticated user...

The vulnerability of the set_course_mode_price() function on the online training platform Open edX allows a violator to gain access to read and modify data.

The vulnerability of the setcoursemodeprice function on the online training platform Open edX is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain access and modify data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106171 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server:...

CVE-2026-78596 Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

Kibana 8.19.21, 9.4.6, 9.5.3 Security Update (ESA-2026-154)

Missing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated...

kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC

A flaw was found in the Linux kernel's NFSv4 implementation. A local user could exploit a vulnerability where opening a file with OTRUNC truncate and ORDONLY read-only flags would bypass the necessary write permission checks. This oversight allows an attacker to truncate a file without having...

CVE-2026-78609 Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data

Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions confined to a single namespace could cause attacker-controlled certificate material to be included in t...

Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization CWE-863 in Elastic Cloud on Kubernetes ECK can lead to unauthorized modification of data via Metadata Spoofing CAPEC-690. An actor holding limited Kubernetes permissions...

CVE-2026-73757

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery SSRF attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential...

CVE-2026-72641

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only Security Solution read access in a Kibana space could enumerate and change the state of Entity Store...

CVE-2026-78606 Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Where two authenticated principals originating from different authentication realms share the same username value...

CVE-2026-72641

An Incorrect Authorization (CWE-863) flaw in Kibana allows an authenticated user holding only Security Solution read access in a Kibana space to enumerate and modify the state of Entity Store maintainer tasks , silently disabling Entity Analytics maintenance for that space. The root cause is func...