CVE-2026-123809 Dynatrace MCP Server: Workflow template injection via create_workflow_for_notification

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the createworkflowfornotification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressions. A caller can place template...

CVE-2026-123779

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-123779 Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-123779 Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

EUVD-2026-119978

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-123779

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-123779

Apache Axis2/Java versions through 2.0.1 are vulnerable to a Direct Request ('Forced Browsing') vulnerability. The exposeServiceMetadata parameter was improperly enforced, only applying to ?wsdl, ?wsdl2, and ?xsd queries. Consequently, services with this parameter disabled still disclosed sensiti...

PT-2026-140358

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-123779: Apache Software Foundation Apache Axis2/Java: Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java

Direct Request 'Forced Browsing' vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-WSDL ?wsdl=NAME route of the standalone...

CVE-2026-124443

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they...

CVE-2026-124443 Frappe before 16.35.0 Broken Access Control in File List/Report Queries

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they...

CVE-2026-124443

The Frappe Framework versions prior to 15.121.1 and 16.x before 16.35.0 are susceptible to a broken access control vulnerability. The flaw exists within File list and report queries , where the system fails to properly restrict private file records. Consequently, authenticated users can query the...

EUVD-2026-119557

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they...

PT-2026-139959

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they...

CVE-2026-124443: frappe: Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list…

Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they...

CVE-2026-117626

A flaw was found in Jenkins. The file browser for workspaces and user content fails to properly validate file paths, resulting in a path traversal vulnerability. An authenticated attacker with read or workspace permissions can exploit this flaw by submitting crafted requests to obtain sensitive...

UBUNTU-CVE-2026-112910

filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because opennonreparsefd...

AZL-112711 CVE-2026-112910 affecting package python-filelock 3.20.3-4

filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because opennonreparsefd...

CVE-2026-112910 filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL

filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because opennonreparsefd...

EUVD-2026-117809

filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inheritable ACL because opennonreparsefd...