CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

CVE-2026-100286

The Devolutions Server (version 2026.3.5.0 and earlier) is affected by a missing authorization vulnerability in the data source settings API . This flaw allows an authenticated non-administrative user to disclose integration secrets by sending a crafted API request. Exploitation details are not p...

CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

EUVD-2026-89016

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

gha-lab-0ba60e6456

Integration Testing This folder contains the integration tests of the extension. They are defined using Playwright test runner and Galata helper. The Playwright configuration is defined in playwright.config.js. The JupyterLab server configuration to use for the integration test is defined in...

Server-Side Request Forgery

Apache Shiro is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of the form‑resubmit target in the Jakarta EE integration module, where the server will initiate an outbound connection to a URL supplied in a crafted HTTP request and transmit...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri.

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parse...

CVE-2026-102243

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243

A command injection vulnerability exists in MODSetter SurfSense up to version 2.0.3 . The flaw resides in the MCP Connector Integration component, specifically involving unknown processing of the /api/search-source/connectors/mcp/test file. This vulnerability allows for remote attacks. While the ...

CVE-2026-102243 MODSetter SurfSense MCP Connector Integration test command injection

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

EUVD-2026-88609

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

CVE-2026-102243: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely...

This Week in Spring - September 29th, 2026

Hi, Spring fans! Welcome to another rip-roarin' and exciting installment of This Week in Spring! We've got a ton of cool stuff to look at this week, so let's dive right into it! an important update on Spring's release practice Speaking of which, we had a slew of releases on the 24th, including...

CVE-2026-100286: Exposure of Sensitive Information to an Unauthorized Actor

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request...

CVE-2026-81867

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially...

CVE-2026-81375

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-19759

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged...

CVE-2026-81375 Confused Deputy in Application Integration allows Internal File Read

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-81375

Google Cloud Application Integration versions prior to 2026-06-30 are affected by a Confused Deputy vulnerability in the EmailTask component. An authenticated attacker can exploit this by using a crafted attachment file path to read and exfiltrate arbitrary Google-internal files. This vulnerabili...