CVE-2026-65616

The provided documents describe CVE-2026-65616 as an incorrect authorization validation in the refresh token signature that allows non-admin users to obtain a signed JFrog administrator token. This indicates a privilege escalation risk tied to the token signing/validation flow in the JFrog produc...

CVE-2026-65616

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

EUVD-2026-49576

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-65616 Potential privilege escalation to JFrog administrator privileges

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-42017

Technical details (affected products/versions, root cause, exploitability) are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2026-42017 Privilege escalation via JFrog Worker event token exposure

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

EUVD-2026-49566

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

CVE-2026-42016

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

CVE-2026-42016

Affected software : JFrog Artifactory (Self Hosted), prior to version 7.133.11. Vulnerability : Incorrect validation of the user token allows privilege escalation; the underlying issue is validating the token signature/issuer rather than the token’s scope. Impact : Privilege escalation with high ...

CVE-2026-42016 Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation

JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

EUVD-2026-49407

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481 Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481

CVE-2026-16481 affects the cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox. The vulnerability is a Server-Side Request Forgery (SSRF) that also exfiltrates credentials. The tool accepts an unvalidated pageURL and issues an HTTP GET via an authenticated client, with the transport a...

CVE-2026-16481 Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-17569

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

CVE-2026-17569

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

CVE-2026-17569

CVE-2026-17569: Improper access control in the NetBox synchronizer of Devolutions Server allows an authenticated user with view-only access on an entry to retrieve a stored API token via the partial connection endpoint. Affected products/versions include Devolutions Server 2026.2.4.0 through 2026...

EUVD-2026-49379

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...

CVE-2026-17569

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server...