PT-2026-78371

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

PT-2026-78816

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description A user with the get talos enrichment capability can send a crafted request to the Talos intelligence enrichment REST API endpoint, forcing the instance ...

EUVD-2026-61485

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-61696 Forem: Stored XSS in Admin Abuse Report Rendering

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-61696 Forem: Stored XSS in Admin Abuse Report Rendering

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

EUVD-2026-61136

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-66782 Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account SA bearer token within the Submariner Custom Resource CR specification. An attacker with access to the cluster's etcd database or through kubectl get commands could obtai...

CVE-2026-62684

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

EUVD-2026-60961

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

EUVD-2026-60479

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-64859

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

PYSEC-2026-3759

opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...

BIT-CONSUL-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

BIT-CONSUL-2026-14869 terraform-mcp-server vulnerable to server side request forgery leading to token exposure

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled...

PT-2026-76866

Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.1.10 Onyx versions prior to 3.2.14 Onyx versions prior to 4.0.0 Description An issue exists where the 'GET /api/mcp/servers' and 'GET /api/mcp/servers/persona/persona id' endpoints expose the OAuth Authorization header...

CVE-2026-73304 Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

hashi-vault-js: Vault token and secret values exposed in thrown errors

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...