7079 matches found
CVE-2025-69196 FastMCP OAuth Proxy token reuse across MCP servers
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for...
CVE-2025-69196 FastMCP OAuth Proxy token reuse across MCP servers
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for...
CVE-2025-69196 FastMCP OAuth Proxy token reuse across MCP servers
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for...
USN-8099-1: curl vulnerabilities
Zhicheng Chen discovered that curl could incorrectly reuse the wrong connection for Negotiate-authenticated HTTP or HTTPS requests. This could result in the use of credentials from a different connection, contrary to expectations. This issue only affected Ubuntu 20.04 LTS. CVE-2026-1965 It was...
Incorrect Authorization
Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization via the upload process. An attacker can bypass team-specific file upload restrictions by uploading files in a team where...
EUVD-2026-12425
Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to validate team-specific uploadfile permissions which allows a guest user to post files in channels where they lack uploadfile permission via uploading files in a team where they have permission and reusing the file...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the upload process. An attacker can bypass team-specific file upload restrictions by uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team...
EUVD-2025-208759
FastMCP OAuth Proxy token reuse across MCP servers...
CVE-2026-4265
Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to validate team-specific uploadfile permissions which allows a guest user to post files in channels where they lack uploadfile permission via uploading files in a team where they have permission and reusing the file...
A week in security (March 9 – March 15)
Last week on Malwarebytes Labs: Watch out for fake Malwarebytes renewal notices in your calendar Google patches two Chrome zero-days under active attack. Update now Attackers impersonate Temu in ClickFix $Temu airdrop scam Apple patches Coruna exploit kit flaws for older iOS versions This Android...
CVE-2026-20991
Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents...
CVE-2026-20991
Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents...
CVE-2026-20991
Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents...
The vulnerabilities of the functions arch_dup_task_struct() and copy_thread() in the arch/s390/kernel/process.c module of the S390 platform support module of the Linux operating system allow a hacker to cause a service failure.
The vulnerability of the functions archduptaskstruct and copythread in the arch/s390/kernel/process.c module, which is part of the S390 platform support for the Linux operating system, relates to the re-release of previously released memory. Exploiting this vulnerability could allow an attacker t...
SAMSUNG ThemeManager 安全漏洞
Samsung ThemeManager is a theme management tool developed by South Korea’s Samsung Corporation. Versions of Samsung ThemeManager prior to the Mar-2026 Release 1 version contained security vulnerabilities. These vulnerabilities were due to improper permission management, which could allow local...
The vulnerability of the shutdown_interception() function in the arch/x86/kvm/svm/svm.c module of the virtualization subsystem on the Linux kernel-based x86 platform allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the shutdowninterception function in the arch/x86/kvm/svm/svm.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the...
The vulnerability of the f2fs_free_dic() function in the fs/f2fs/compress.c module of the F2FS file system in the Linux operating system allows a hacker to trigger a service failure.
The vulnerability of the f2fsfreedic function in the fs/f2fs/compress.c module of the F2FS file system in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
EUVD-2026-11756
The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler handleonetimestripelinkreturnurl marking payment records as complete based solely on the Stripe PaymentIntent status...
Incorrect Authorization
Overview @openclaw/zalouser is an OpenClaw Zalo Personal Account plugin via native zca-js integration Affected versions of this package are vulnerable to Incorrect Authorization in the channels.zalouser.groups. An attacker can gain unauthorized access to restricted channels by reusing a display...
