ROS-20261002-73-0156

The vulnerability of the RC-server of the cloud synchronization tool Rclone relates to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request to the operations/fsinfo endpoi...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

GO-2026-6576 Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve

Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve...

GO-2026-6579 OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao

OpenBao Skips Stricter Deny Policy for LIST operations in github.com/openbao/openbao...

CVE-2026-97662

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

SummaryENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

CVE-2026-82828

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-82825 Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...

CVE-2026-82825

The Hitachi Coding Software Suite (versions through 3.3.0) is vulnerable to a Missing Authentication for Critical Function flaw. This vulnerability allows an unauthenticated attacker to invoke a critical API, which may lead to the unauthorized retrieval or alteration of sensitive information, or ...

CVE-2026-82828 Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-82828 Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

EUVD-2026-90491

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CLEANSTART-2026-KF94035 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51896: Improper Access Control

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51895: Improper Access Control

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-103965

Name of the Vulnerable Software and Affected Versions AWS security-agent-mcp-server versions prior to 0.2.0 Description An argument injection issue exists in the diff scan operation. A threat actor can provide a crafted reference value to the diff scan operation to create, overwrite, or truncate...

CVE-2026-82828: Incorrect Authorization

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

PT-2026-103687

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...