CVE-2026-105797 SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-105797 SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-78234

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name CN supplied by the author of a namespaced Hawtio custom resource. Because the operator...

CVE-2026-72654 Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

CVE-2026-72654

CVE-2026-72654 is an Execution with Unnecessary Privileges (CWE-250) vulnerability in the Kibana machine learning feature . An operation available to users with only read access to the ML feature was executed using an internal service identity rather than the requesting user's own identity, allow...

PT-2026-84390

Execution with Unnecessary Privileges CWE-250 in the Kibana machine learning feature can lead to information disclosure via Privilege Abuse CAPEC-122. An operation available to users holding only read access to the machine learning feature was performed with an internal service identity rather th...

EUVD-2013-7072

Malware in sbrugna...

EUVD-2021-1430

Malware in sbrugna...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers

A vulnerability was identified in Consul such that using JWT authentication for service mesh incorrectly allows/denies access regardless of service identities. This vulnerability, CVE-2023-3518, affects Consul 1.16.0 and was fixed in 1.16.1...

CVE-2023-3518 JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

HashiCorp Consul and Consul Enterprise 1.16.0 when using JWT Auth for service mesh incorrectly allows/denies access regardless of service identities. Fixed in 1.16.1...

SUSE-SU-2021:2817-1 Security update for aws-cli, python-boto3, python-botocore, python-service_identity, python-trustme, python-urllib3

This patch updates the Python AWS SDK stack in SLE 15: General: aws-cli - Version updated to upstream release v1.19.9 For a detailed list of all changes, please refer to the changelog file of this package. python-boto3 - Version updated to upstream release 1.17.9 For a detailed list of all change...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2013-7295

Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for 1 relay identity keys and 2 hidden-service identity keys, which might make it easier for remote attackers...

PT-2014-3339

Name of the Vulnerable Software and Affected Versions Tor versions prior to 0.2.4.20 Description The issue affects Tor when used with OpenSSL 1.x and a specific HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms. It does not properly generate random numbers for relay identity ke...