CVE-2026-126225

A missing authorization vulnerability (CWE-862 ) exists in FortiAnalyzer , FortiAnalyzer Cloud , FortiManager , and FortiManager Cloud (versions 8.0.0 through 8.0.1 and 7.6.7). An authenticated attacker can leverage a crafted JSON-RPC request to perform privilege elevation . The impact includes h...

CVE-2026-126211

An improper privilege management vulnerability (CWE-269) exists in several Fortinet products, including FortiAnalyzer , FortiAnalyzer Cloud , FortiManager , and FortiManager Cloud . The issue affects FortiAnalyzer versions 8.0.0-8.0.1 and 7.6.1-7.6.7, and FortiManager versions 8.0.0-8.0.1 and 7.6...

Improper privilege management

An improper privilege management vulnerability CWE-269 in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated privileged attacker to elevate their privileges via crafted JSON-RPC request...

Missing authorization

A missing authorization vulnerability CWE-862 in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud may allow an authenticated attacker to elevate their privileges via crafted JSON-RPC request...

CVE-2026-111770

The @modelcontextprotocol/server TypeScript SDK (versions 2.0.0 through 2.2.0 ) contains a race condition where shared stateless HTTP transports or server instances can deliver messages to the wrong clients. This occurs because messages are matched using only the JSON-RPC request identifier , and...

CVE-2026-111770 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients...

CVE-2026-111770 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients...

CVE-2018-1163: Improper Authentication

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to...

PT-2017-3511

Name of the Vulnerable Software and Affected Versions Quest NetVault Backup version 11.2.0.13 Description This issue allows remote attackers to bypass authentication on vulnerable installations. The flaw exists within JSON RPC Request handling, specifically by setting the checksession parameter t...