CVE-2026-108586

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108586 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108586 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108586

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-108586

The 1MCP Agent (@1mcp/agent) versions 0.20.0 through 0.39.0 are vulnerable to an incorrect authorization issue (CWE-863). This flaw allows authenticated clients to bypass OAuth tag-scope enforcement by utilizing negated advanced tag-filter expressions . Specifically, an attacker possessing a toke...

EUVD-2026-96373

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

CVE-2026-101921

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

EUVD-2026-96278

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-101921 WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-101921

The WPForms WordPress plugin (versions up to and including 2.0.2.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the 'query_var' Smart Tag parameter. An unauthenticated attacker can inject arbitrary web sc...

ida_ifl

IFL - Elenco interattivo delle funzioni Licenza: CC-BY https://creativecommons.org/licenses/by/3.0/ Un piccolo plugin con l'obiettivo di fornire un modo intuitivo per navigare tra le funzioni e i loro riferimenti. Inoltre, consente di importare report generati ad esempio da PE-sieve in IDA...

CVE-2026-96682

The Presto Player plugin for WordPress (versions up to and including 4.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the comment content via the tag. An unauthenticated attacker can inject arbitrary web scr...

EUVD-2026-96106

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96682 Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CLEANSTART-2026-XK50947 Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly

Security vulnerability affects the apache-nifi package. The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly...

CVE-2026-101921: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-102774: Improper Neutralization of Input During Web Page Generation

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

PT-2026-109595

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

CVE-2026-108586: Incorrect Authorization

1MCP Agent @1mcp/agent 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not to list and invoke...

RUSTSEC-2026-0337 Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more

Poly1305 in ic-cipher absorbs messages of 64 bytes or more four blocks at a time, summing four products before one reduction. From 0.2.5 to 0.2.19 the reduction kept its carries in 32-bit integers, which four summed products can overflow when the message's bytes are large. This affects Poly1305 a...