PYSEC-2026-3484 meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...

CVE-2026-15394 Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15647

Affected software: Brands for WooCommerce (WordPress plugin). Vulnerable component: br_brand_tooltip term meta; root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers with custom-level access can store scripts via term meta, leading to stored XSS when pag...

EUVD-2026-47924

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'brbrandtooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

CVE-2026-13057

CVE-2026-13057 affects the server’s Atlas Search integration (MongoDB) in sharded topologies. An authenticated client can bypass per-user access controls by supplying internal routing fields for the $search and $searchMeta aggregation stages, which are normally populated only by the trusted route...

CVE-2026-13057 Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...

Authorization Bypass via Client-Supplied $search.mergingPipeline Leaks Unauthorized Collection Data Through $$SEARCH_META

An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies, the $search and $searchMeta aggregation stages use internal routing that is normally populated only by the trusted router during sharded search planning. Due t...

CVE-2026-9737

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

CVE-2026-9737 Find command with $meta sort can lead to crash

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

CVE-2026-9737

CVE-2026-9737 concerns MongoDB during query planning when reading a sort pattern in raw BSONObj form. In some cases, the code does not explicitly handle the meta expression, which may cause incorrect transformations and lead to an invariant failure (potential crash). The issue is reflected in the...

EUVD-2026-47775

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

Find command with $meta sort can lead to crash

During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t explicitly handle the meta expression case. This may lead to incorrect transformations leading to invariant failure...

PT-2026-63486

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description During query planning when reading the sort pattern in raw BSONObj form, the system fails to explicitly handle the meta expression case. This oversight can resul...

GHSA-P4MJ-98MV-XQ26 Gitea: Private Repository Existence Disclosure via go-get Meta Endpoint

| Field | Value | |-------|-------| | Affected File | routers/web/repo/githttp.go, services/context/repo.go | | Affected Functions | httpBase, EarlyResponseForGoGetMeta | | Affected Lines | githttp.go:63–66, services/context/repo.go:374–396 | | Prerequisite | None — fully unauthenticated | ---...

CVE-2026-60080

CVE-2026-60080 is a use-after-free in the Rust deserialization logic of Apache Fory. The vulnerability affects Apache Fory versions from 0.13.0 through 1.3.0. A crafted Fory payload can lead to undefined behavior, a process crash, or potential memory disclosure. The recommended remediation is upg...

CVE-2026-63817

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate compress cache inode only when enabled F2FSCOMPRESSINO uses NMIsbi-maxnid as the synthetic inode number for the compressed page cache inode. That inode only exists when the compresscache mount option is enabled. Wh...

OESA-2026-3057 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

CVE-2026-54549

creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:08+00:00| published-proof-of-concept| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-45gf-fjxp-cjpq...

GHSA-2V2F-MVFG-PH56 meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...