CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

EUVD-2026-101528

Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4...

EUVD-2026-101514

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-102031 Junos OS Evolved: A low-privileged TACACS+ user causes root command execution when authorization refresh is enabled

An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled...

CVE-2026-89072

Incorrect Authorization vulnerability in Progress MOVEit Transfer Client Certificates module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

Dokploy authorization issue vulnerability

Dokploy versions 0.30.8 and earlier have an authorization issue vulnerability. This vulnerability stems from the port tRPC router not verifying the organization to which the target application belongs. As a result, cross-organizational authorization bypasses occur. Attackers can read, modify,...

HPE NonStop TCP/IP UTILITIES authorization issue vulnerability

The HPE NonStop TCP/IP UTILITIES T8602L01^BAA and earlier versions contain an authorization issue vulnerability. This vulnerability stems from a flaw in the finger daemon, potentially allowing unauthenticated remote attackers to cause a denial of service...

Eclipse Jetty authorization issue vulnerability

Versions 12.1.0 through 12.1.12 of Eclipse Jetty contain an authorization issue vulnerability. This vulnerability arises because EthereumAuthenticator uses unanchored substring matching when identifying login pages. When the latter part of a protected request path contains a configured login path...

WordPress Ninja Forms Signature Contract Add-On Authorization Issue Vulnerability

WordPress Ninja Forms’ Signature Contract Add-On versions 3.2.5 and earlier have a vulnerability related to authorization. This vulnerability stems from a lack of proper permission authorization, which may lead to improper configuration of access control security levels being exploited...

HPE NonStop TCP/IP UTILITIES authorization issue vulnerability

The HPE NonStop TCP/IP UTILITIES T8602L01^BAA and earlier versions contain an authorization issue vulnerability. This vulnerability stems from a flaw under certain conditions when performing traceroute, potentially allowing unauthenticated remote attackers to cause a denial of service...

EasySoft Zentaopms Authorization Issue Vulnerability

EasySoft ZentaOPMS versions 22.6 and earlier have an authorization vulnerability. This vulnerability stems from an authorization bypass in the action::editComment function. Certified users can read and modify comments on products and projects that they do not have access to by providing any actio...

Cole Medin Archon Authorization Issue Vulnerability

Cole Medin Archon versions 0.2.13 to 0.11.1 have an authorization issue vulnerability. This vulnerability stems from the lack of authentication. Unauthenticated attackers can access the control APIs bound to 0.0.0.0/api/, potentially allowing them to execute commands on the host as an Archon user...

Peppermint Lab Ticket Management System authorization issue vulnerability

The Peppermint Lab Ticket Management System versions 0.5.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation; any authenticated user can create time entries and attachments under another user’s identity by providing their us...

Shy Alter Craftplan Authorization Issue Vulnerability

Shy Alter Craftplan versions 0.7.5 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification for CRM customer resources. Unauthenticated attackers can create customer records by sending anonymous requests via JSON:API and GraphQL,...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue. This vulnerability stems from the lack of method-level authorization checks in the user management endpoint PUT /api/users/resetPwd. Additionally, in UserServiceImpl.resetPwd, there is no role-level or ownership verification. This coul...

ZoneMinder authorization issue vulnerability

The ZoneMinder versions 1.34.0 to 1.36.63 contain security vulnerabilities. These vulnerabilities stem from improper handling of token authentication in the web/includes/auth.php file. The validateToken function returns false for or invalid tokens. However, the calling party assigns this value to...

AtalayaLabs OxiCloud Authorization Issue Vulnerability

The AtalayaLabs OxiCloud versions 0.9.1 to 0.9.3 have an authorization issue vulnerability. This vulnerability stems from improper authorization handling. Attackers can access shared files or folder contents by making a GET /api/files/id request, even after password protection has been applied...

CRMEB crmeb_java authorization issue vulnerability

CRMEB crmebjava 3.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from an authorization bypass. Attackers can obtain order information from other members by requesting APIs like/api/front/order/express/orderId or/api/front/order/apply/refund/orderId. Thi...