CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-44506

Medplum , a developer platform for healthcare apps, had a flaw in versions 4.1.10 through 5.1.6 affecting self-hosted configurations . The /oauth2/register endpoint (OAuth dynamic registration) could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients serve...

CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-77121

Sonatype Nexus Repository 3 is affected by a denial of service vulnerability caused by unbounded Maven POM metadata fields. A user with permission to deploy artifacts to a hosted Maven repository can upload a POM file containing an oversized metadata field , which causes future attempts to list o...

CVE-2026-41653

CVE-2026-41653 : BentoPDF ≤ 2.8.2 - XSS stocké → Exfiltration de fichiers Découvert et signalé par : Astaruf Analyse complète : https://nstsec.com/en/posts/bentopdf-xss-cve-2026-41653/ Avis en amont : Avis GHSA de alam00000/bentopdf Entrée NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-41653...

Sentora

Sentora Community Edition Self-hosted security stack for small/mid teams that don't have a dedicated SOC. Drop an agent on each endpoint, point them at the server, and you get SIEM logs, file integrity, package vulnerabilities, an OpenSearch-powered log explorer, autonomous AI triage and a SOAR...

TCL-xss-Labs

مختبر XSS — دفتر الأستاذ السيبراني 💸 إذا كان هذا المشروع يساعدك، فكر في دعمه بتبرع بقيمة 10 دولارات للحفاظ على نموه. الرابط: https://rzp.io/rzp/zgkC6h5B منصة تدريب XSS تفاعلية مستضافة ذاتيًا تضم 33 تحديًا متزايد الصعوبة — مصممة للمخترقين، ومختبري الاختراق، والمطورين الذين يرغبون في إتقان البرمجة...

LocalExifGeoMap

Local Exif Geo Map 📍 Un outil puissant, respectueux de la vie privée et fonctionnant dans le navigateur, pour visualiser et analyser les données GPS de vos photos. Déposez simplement des images pour générer des cartes interactives, des cartes de chaleur, des profils d'élévation et des statistique...

CVE-2026-49009

CVE-2026-49009 — Traversée de chemin authentifiée sur Mender Server menant à l'exécution de code à distance Découvert par j0xh-sec via HackerOne · PoC par INTELEON404 Table des matières Résumé de la vulnérabilité Versions concernées Analyse technique Preuve de concept Exploit Python Modèle Nuclei...

tirreno

tirreno tirreno est une solution open source d'analyse de sécurité. tirreno tir.ˈrɛ.no aide à comprendre, surveiller et protéger vos applications contre les cybermenaces, les prises de contrôle de comptes, les bots et les abus. Alors que la cybersécurité classique se concentre sur l'infrastructur...

CVE-2026-34048

CVE-2026-34048 مسار البوتستراب الطرفي المخصص للمسؤولين فقط يتحقق من حالة تسجيل الدخول فقط، مما يسمح لعضو فريق عادي بتشغيل نظام الطرفية الخلفي في الوقت الفعلي لـ Coolify وتنفيذ أوامر على خوادم الفريق. مقدمة وجدت هذه المشكلة أثناء مراجعة Coolify ، وهو نظام PaaS مفتوح المصدر مستضاف ذاتيًا، مع سؤال...

caos-os

CAOS — Système d'exploitation de l'assurance client Répondez aux questionnaires de sécurité que vos clients vous envoient, une seule fois. Toute entreprise qui traite des données clients reçoit sans cesse les mêmes demandes : questionnaires de sécurité, évaluations de confidentialité, examens des...

TeamPass v3.2.2.0

Teampass Self-hosted password management your whole team can trust Folder-level access control · authenticated AES-256-GCM encryption · compliance evidence Your secrets never leave your infrastructure. 🌐teampass.net · 📖Documentation · 💬Discussions · 🐳Docker Hub !Docker...

briefr

BRIEFR Intelligence CVE auto-hébergée pour les analystes qui veulent des réponses, pas un énième flux brut Démo en direct · Documentation · Démarrage rapide · Captures d'écran Qu'est-ce que BRIEFR ? BRIEFR est un tableau de bord d'intelligence CVE auto-hébergé. Il récupère les flux publics de...

openclaw

OpenClaw 🦞 — Your assistant, on your devices, in your chats OpenClaw is an AI assistant that runs on your devices and meets you in the channels you already use. It connects models, tools, messaging channels, and optional companion apps through one Gateway, for a single operator or for a team whos...

EUVD-2026-67218

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended. ServiceNow deployed a...

PT-2026-82363

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...

CVE-2026-62865

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the...

CVE-2026-62865 TypeBot: Arbitrary server file read via Send Email block attachment path

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the...

CVE-2026-62865 TypeBot: Arbitrary server file read via Send Email block attachment path

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the...