CVE-2026-1486 Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

Improper Verification of Cryptographic Signature

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the invitation tokens in the registration process. An...

CVE-2026-25846

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...

CVE-2026-25846

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...

CVE-2026-25846

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...

CVE-2026-25846

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...

CVE-2026-25846

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...

CVE-2026-25846

CVE-2026-25846 affects JetBrains YouTrack prior to 2025.3.119033, where access tokens could be exposed in Mailbox logs. The provided documents identify the affected product and the exposure risk (confidentiality impact HIGH; overall CVSS 6.5, Network attack vector, Low attack complexity, Privileg...

JetBrains YouTrack 日志信息泄露漏洞

JetBrains YouTrack is a browser-based error tracking and project management software developed by Czech company JetBrains. This software features error tracking, workflow creation, and project progress monitoring. Versions of JetBrains YouTrack prior to 2025.3.119033 contained a log information...

Cube 安全漏洞

Cube is a semantic layer for building data applications developed by Cube OpenSource. There were security vulnerabilities in versions of Cube between 0.27.19 and 1.5.13, as well as in versions before 1.4.2 and 1.0.14. These vulnerabilities stemmed from the possibility of privilege escalation when...

PT-2026-7122

Name of the Vulnerable Software and Affected Versions Fiber versions prior to 2.52.11 Fiber versions prior to 2.52.11 running on Go versions prior to 1.24 Description The Fiber framework, an Express-inspired web framework written in Go, is susceptible to generating predictable identifiers when...

JetBrains YouTrack < 2025.3.119033 Information Disclosure

The version of JetBrains YouTrack installed on the remote host is prior to 2025.3.119033. It is, therefore, affected by an information disclosure vulnerability: - In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs. CVE-2026-25846 Note that Nessus has not...

PT-2026-7104

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs...

EUVD-2026-5570

Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacker could extract sensitive data emails, password...

CVE-2026-25650

MCP Salesforce Connector is a Model Context Protocol MCP server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10...

CVE-2026-25650 MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token

MCP Salesforce Connector is a Model Context Protocol MCP server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10...

EUVD-2026-5627

MCP Salesforce Connector is a Model Context Protocol MCP server implementation for Salesforce integration. Prior to 0.1.10, arbitrary attribute access leads to disclosure of Salesforce auth token. This vulnerability is fixed in 0.1.10...

Information Exposure

Overview mcp-salesforce-connector is an A Model Context Protocol MCP server implementation for Salesforce integration Affected versions of this package are vulnerable to Information Exposure due to arbitrary attribute access. An attacker can obtain sensitive bearer tokens by accessing arbitrary...

MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

Impact Disclosure of Salesforce OAuth bearer tokens used by the MCP. Patches fix applied in 0.1.10 Workarounds Rotate any Salesforce tokens/credentials used by MCP-Salesforce...

GHSA-VF6J-C56P-CQ58 MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

Impact Disclosure of Salesforce OAuth bearer tokens used by the MCP. Patches fix applied in 0.1.10 Workarounds Rotate any Salesforce tokens/credentials used by MCP-Salesforce...