CVE-2026-47660 Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit oauthMetadataUrl parameter that is not validated against...

PT-2026-34041

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.215 Description The mailbox OAuth disconnect action is implemented using a GET request at the endpoint '/mailbox/oauth-disconnect/id/in out/provider'. This action removes stored OAuth metadata from the mailbox a...