3727 matches found
PT-2026-84166
Name of the Vulnerable Software and Affected Versions ArmorStart® LT affected versions not specified Description A denial-of-service issue exists in the embedded web server due to improper handling of a specially crafted HTTP PUT request. This flaw can lead to a loss of web server availability...
CVE-2026-79744
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...
CVE-2026-79744
MCPHub is a unified hub for centrally managing and orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29 , the PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check — it is protected only by...
CVE-2026-79748: Missing Authorization
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...
CVE-2026-79744: Improper Privilege Management
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...
PT-2026-83942
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...
CVE-2026-82290
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...
CVE-2026-55068
free5GC is an open-source implementation of the 5G core network. In 4.2.2 and earlier, the NRF RegisterNFInstance handler at PUT /nnrf-nfm/v1/nf-instances/nfInstanceID accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or...
CVE-2026-54766
Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...
EUVD-2026-67821
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...
CVE-2026-82290 Chainlit Feedback Endpoints Missing Ownership Validation
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...
CVE-2026-82290
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...
CVE-2026-80683
CVE-2026-80683 is a use-after-free vulnerability in the Linux kernel's Bluetooth SCO subsystem . The root cause is a reference-counting bug: the SCO socket stores a sco_conn pointer without holding its own reference. When a socket close() races the Bluetooth controller's Disconnection Complete ev...
SUSE CVE-2026-72177
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: fix dir put orders in accesspatternadddirs Patch series "mm/damon/sysfs-schemes: fix wrong directories put orders in error paths". Error paths of damonsysfsaccesspatternadddirs and damonsysfsschemeadddirs...
SUSE CVE-2026-72214
In the Linux kernel, the following vulnerability has been resolved: power: supply: cpcap-battery: Fix missing nvmemdeviceput causing reference leak In cpcapbatterydetectbatterytype, the reference to an nvmem device obtained via nvmemdevicefind is not released with nvmemdeviceput on the success or...
CVE-2026-82290: Authorization Bypass Through User-Controlled Key
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...
CVE-2026-54766: Improper Authorization
Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...
PT-2026-83313
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...
PT-2026-82983
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth SCO Synchronous Connection-Oriented implementation where the sco conn del function drops a reference it does not own. This occurs because the socket stor...