124175 matches found
PT-2026-58884
Name of the Vulnerable Software and Affected Versions Grafana MCP Server affected versions not specified Description A confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the environment-configured Grafana service-account token. This is achieved by supplying a crafted...
CVE-2026-62685: Use of Non-Canonical URL Paths for Authorization Decisions
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...
PT-2026-60384
Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0 Description An authenticated user can trigger server-side requests to internal destinations, such as loopback, Docker bridge, or RFC1918 HTTP addresses, because the Subsonic-compatible createPodcastChannel.view...
PT-2026-60190
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an...
CVE-2026-15583: Externally Controlled Reference to a Resource in Another Sphere
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...
RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) (RHSA-2026:39810)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:39810 advisory. Security Fixes: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 golang: Denial of Service due to excessive...
Open WebUI AI-based web interface SSRF
The vulnerability of the processpictureurl function in the backend/openwebui/utils/oauth.py file of the Open WebUI artificial intelligence-based web interface is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to perform an SSRF...
Grafana MCP server-side request forgery via X-Grafana-URL header
A vulnerability has been discovered in the mcp-grafana project https://github.com/grafana/mcp-grafana where a confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request...
PT-2026-60365
Name of the Vulnerable Software and Affected Versions Pomerium versions prior to 0.32.8 Description Pomerium is an identity and context-aware access proxy. In hosted or stateless authentication deployments, the /.pomerium/callback endpoint is reachable without credentials and processes...
CVE-2026-36035
creationtimestamp| type| source ---|---|--- 2026-07-14 23:54:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfqvwm4q27 2026-07-27 09:05:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmk5mowaa27...
CVE-2026-48337
creationtimestamp| type| source ---|---|--- 2026-07-14 23:01:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqncs7pxyz2c...
CVE-2026-15774
creationtimestamp| type| source ---|---|--- 2026-07-14 22:59:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqncoq3d3f2g 2026-07-15 23:42:46+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116926641968349809 2026-07-16 04:45:29+00:00| seen|...
CVE-2026-48287
CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must...
CVE-2026-15750
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcpgetComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack ma...
GHSA-MQXV-9RM6-W8QC
creationtimestamp| type| source ---|---|--- 2026-07-14 22:13:10+00:00| seen| https://gist.github.com/alon710/c304e0355d4b523094aabb49f860b83c...
CVE-2026-54052
creationtimestamp| type| source ---|---|--- 2026-07-14 22:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqn7siy2dj2q 2026-07-15 22:00:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqppubmqtj2w 2026-07-16 00:34:33+00:00| seen|...
CVE-2026-42447 jadx: HTML Injection in Summary panel
jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerability in the Summary tab because SummaryNode.java appends arches and perArchCount values derived from .so file path components inside an APK into an HTML panel without escaping. A malicious APK wit...
CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...
CVE-2026-59733
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...
CVE-2026-59733
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...