75347 matches found
ECHO-0E8E-B96F-3BFA
Bulletin has no description...
CVE-2026-62218
creationtimestamp| type| source ---|---|--- 2026-07-17 02:47:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsqdez4ne2l 2026-07-22 09:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr7zkz3jvo26...
CGA-766C-2F7J-5H8J
Bulletin has no description...
GHSA-VWJC-V7X7-CM6G
creationtimestamp| type| source ---|---|--- 2026-07-17 00:31:31+00:00| seen| https://gist.github.com/alon710/aa823e4042d20db07abf6864647f71af...
CVE-2026-63099: Authorization Bypass Through User-Controlled Key
TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to access attachments belonging to other organizations by supplying a content-hash identifier. Attackers can exploit the missing...
EUVD-2026-45072
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC...
CVE-2026-44436 Quicly is vulnerable to connection state corruption
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, Quicly is vulnerable to a Denial of Service attack through connection state corruption. In QUIC Invariants, the maximum length of a Connection ID is 255 bytes, while QUIC...
CVE-2026-14253
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-11740
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-45334
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting user's access permissions. Kirby's Panel includes a content-locking feature that records which user currently has a model...
CVE-2026-55579
creationtimestamp| type| source ---|---|--- 2026-07-16 20:54:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqs4ly7n6q2w 2026-07-16 22:35:03+00:00| published-proof-of-concept| https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2 2026-07-17...
CVE-2026-47088
creationtimestamp| type| source ---|---|--- 2026-07-16 20:34:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqs3jia3bi2e...
GHSA-JPW9-PFVF-9F58
creationtimestamp| type| source ---|---|--- 2026-07-16 20:31:08+00:00| seen| https://gist.github.com/alon710/1d517629bc176ae6cad3ee2369704fcb...
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...
EUVD-2026-44795
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal...
GHSA-JPW9-PFVF-9F58 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...
Authorization Bypass Through User-Controlled Key
Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in SseServerTransport and StreamableHTTPSessionManager, which look up a session by the sessionid query parameter or Mcp-Session-Id header without...
CVE-2026-55584
creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:31+00:00| seen| Telegram/LNuOwlUx2r8sHZb96-V-EdvdoeXbPnJG4sUQQILzuVbIDko 2026-07-17 00:00:48+00:00| seen| Telegram/LNuOwlUx2r8sHZb96-V-EdvdoeXbPnJG4sUQQILzuVbIDko 2026-07-18 04:00:03+00:00| published-proof-of-concept|...
CVE-2026-0000
creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:26+00:00| seen| Telegram/JkDbnMq7GUm5Q4-RPLqs1gjre-Qc5RO5Ni4r9-mJNxKuLM 2026-07-17 00:00:43+00:00| seen| Telegram/JkDbnMq7GUm5Q4-RPLqs1gjre-Qc5RO5Ni4r9-mJNxKuLM 2026-07-18 00:00:08+00:00| published-proof-of-concept|...