CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider contains a vulnerability where it fails to verify the signature of JSON Web Tokens (JWT) during authorization. When anonymousUserRole is set to a non-empty value and strictAuthMethod is false (default), requests with failed credentials may fall...

CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

EUVD-2026-107421

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...

DRUPAL-CONTRIB-2026-238

This module enables you to share users, content and configuration across a group of domains from a single Drupal installation. Its Domain Access submodule controls which domains a user may edit content on, and has an optional setting to grant user access per content type. The module doesn't...

DRUPAL-CONTRIB-2026-235

This module allows granting access to unpublished nodes per content type. For nodes with at least one unpublished translation, the module grants every user with the "access content" permission view access to the published translations of that node. This overrides the restrictions of other node...

DRUPAL-CONTRIB-2026-233

Swiper is mobile first, layout and gestures wise, it provides great amount of options for designing your own widget and related events. This module provides a route for displaying published content entities in a dialog. The route does not sufficiently verify the current user's access to the...

CVE-2026-114131

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...

DRUPAL-CONTRIB-2026-227

The Dopup module provides functionality for selecting and working with Webforms. The module does not perform sufficient entity access checking in some cases and may expose the title of private Webforms...

CVE-2026-76487

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

CVE-2026-76478

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P, Cisc...

CVE-2026-113800

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermissionCheckHandler to receive the top-level frame's origin and...

CVE-2026-114123

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

SUSE CVE-2026-80353

Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the sam...

CVE-2026-114123

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

EUVD-2026-107365

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

CVE-2026-114123 D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

CVE-2026-114123 D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

CVE-2026-114123

The D365 F&O MCP Server is vulnerable to unauthenticated access in versions prior to 1.11.0 due to insecure default configurations in the official Azure one-click deployment. The deployment files (infrastructure/azuredeploy.json and infrastructure/main.bicep) default the apiKey to an empty string...

SUSE CVE-2026-113029

Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...