8432 matches found
CVE-2026-96446
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...
CVE-2026-96446 Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...
EUVD-2026-84951
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...
PT-2026-97287
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Pushed Authorization Request PAR implementation. When the silent authentication path prompt=none is used, the authorization process may skip specific steps for users who...
CVE-2026-96446: Missing Authorization
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...
Linux Distros Unpatched Vulnerability : CVE-2026-61630
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused...
CVE-2026-19202
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...
CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...
CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...
CVE-2026-19202
The mcp-toolbox-sdk-python SDK contains a caching flaw within its toolbox-core package. The module-level token cache fails to uniquely key Google ID tokens by the requested audience. If an application authenticates to multiple audiences (e.g., Service A and Service B) within the same process, a v...
CVE-2026-19202 Token Cache Reuse in mcp-toolbox-sdk-python
A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...
CVE-2026-77268
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...
EUVD-2026-84757
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...
CVE-2026-77268 MCP Atlassian: Insecure File Permissions on OAuth Token Storage
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...
CVE-2026-77268
The MCP Atlassian Model Context Protocol server for Confluence and Jira is vulnerable to insecure file permissions in versions prior to 0.22.0 . The application creates the OAuth fallback token directory and JSON file without explicit owner-only modes. This allows local users or processes with gr...
curl security update
An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
RLSA-2026:69126 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...
CVE-2026-94455
An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...
RLSA-2026:69125 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: curl: Information...
CVE-2026-77268: Incorrect Permission Assignment for Critical Resource
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through the resulting group or world permission bi...