CVE-2023-27524

CVE-2023-27524 Insecure Default Configuration in Apache Superset Leads to Remote Code Execution Screenshot Requirements Python3.7+ Supported Os Linuxer Wingays Get start with $ git clone https://github.com/Pari-Malam/CVE-2023-27524 $ cd CVE-2023-27524 $ pip/pip3 install -r requirements.txt $...

CVE-2023-27524

CVE-2023-27524 Apache Superset Auth Bypass CVE-2023-27524 Reference https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://github.com/horizon3ai/CVE-2023-27524 https://www.horizon3.ai/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

CVE-2026-103091

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-103091

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 are vulnerable to Missing Authorization (CWE-862) and Insecure Default (CWE-1188) . The issue originates in the MCP proxy (HandleStreamPassThrough in mcp_service.go) and the OIDC registration flow (GET /info and POST /regist...

CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

EUVD-2026-104050

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)

Missing Authorization CWE-862 and Initialization of a Resource with an Insecure Default CWE-1188 in the MCP proxy HandleStreamPassThrough in mcpservice.go and OIDC registration flow GET /info and POST /register in internal/controlplane/server.go in Google OSS Agent Mesh SAM versions 0.1.0-alpha.1...

PT-2026-117210

Name of the Vulnerable Software and Affected Versions Google OSS Agent Mesh SAM versions 0.1.0-alpha.1 through 0.1.0-alpha.8 Description Missing authorization and the use of insecure default resource initialization allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools...

CVE-2026-23744

CVE-2026-23744: Unauthenticated Remote Code Execution in @mcpjam/inspector DISCLAIMER: This repository and the associated scripts are intended solely for authorized security assessments, penetration testing, security research, and educational analysis. Unauthorized testing of systems without...

CVE-2026-103577: Insecure Default Variable Initialization

Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network...

EUVD-2026-96925

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API key...

BIT-THRIFT-2026-94634 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-78018

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-78013

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information...

CVE-2026-78018

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

EUVD-2026-95568

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-78018

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16 , is vulnerable to an Initialization of a Resource with an Insecure Default (CWE-1188). This flaw could allow a low privileged attacker with local access to cause information disclosure . To remediate this vulnerabilit...