CVE-2026-34200

Nhost MCP Server: ワンクリックでのインフラ侵害 公式アドバイザリ: この脆弱性はNhostによって確認・公開されました: GHSA-6c5x-3h35-vvw2 このリポジトリは、Nhost Local MCP Server の脆弱性を文書化したものです。このサービスはインバウンド認証を欠き、寛容なCORSポリシーを実装しているため、認証なしでのクロスオリジンリクエスト実行が可能です。 nhost mcp がアクティブな状態で攻撃者が管理するオリジンを一度訪問するだけで、プロジェクト全体が乗っ取られます。実行に成功すると、攻撃者は以下への不正アクセスを獲得します:...

CVE-2026-4644

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This...

CVE-2026-4644

A Missing Authorization vulnerability in the HTTP Connector of Google Cloud Integration Connectors (versions prior to 2025-12-11) allowed an authenticated user to escalate privileges and take over a Google Cloud Project via unauthorized service account attachment. The flaw enabled a user with low...

CVE-2026-4644 Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This...

CVE-2026-4644 Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This...

EUVD-2026-56903

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

CVE-2026-69119: Authorization Bypass Through User-Controlled Key

Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently delete another tenant's project by supplying an arbitrary project ID to the GET and DELETE /projects/id endpoints. The GitHubTokenHTTPAuth...

EUVD-2024-36061

Malicious code in bioql PyPI...

EUVD-2022-51500

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-4138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and...

CVE-2022-4138

A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a...

FreeBSD : kanboard -- Project Takeover via IDOR in ProjectPermissionController (91929399-249e-11ef-9296-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 91929399-249e-11ef-9296-b42e991fc52e advisory. [email protected] reports: Kanboard is project management software that focuses on the...

CVE-2024-36399 Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to...

CVE-2024-36399 Kanboard affected by Project Takeover via IDOR in ProjectPermissionController

Kanboard is project management software that focuses on the Kanban methodology. The vuln is in app/Controller/ProjectPermissionController.php function addUser. The users permission to add users to a project only get checked on the URL parameter projectid. If the user is authorized to add users to...

OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt

Security researchers have uncovered a "credible" takeover attempt targeting the OpenJS Foundation in a manner that evokes similarities to the recently uncovered incident aimed at the open-source XZ Utils project. "The OpenJS Foundation Cross Project Council received a suspicious series of emails...

BIT-GITLAB-2022-4138

A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a...

Cross-Site Request Forgery (CSRF)

gitlab is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability allows a malicious attacker to gain access and control a project if the owner uploads a file to a malicious project...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs when a malicious project maintainer can create a Project Access Token with Owner level privileges which could allow the attacker to take control of the project...

CVE-2022-4138

A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a...

UBUNTU-CVE-2022-4138

A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a...