CVE-2026-65616

The provided documents describe CVE-2026-65616 as an incorrect authorization validation in the refresh token signature that allows non-admin users to obtain a signed JFrog administrator token. This indicates a privilege escalation risk tied to the token signing/validation flow in the JFrog produc...

EUVD-2026-49576

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-65616

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token...

CVE-2026-66015 JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

CVE-2026-66015 JFrog Platform contains an authorization flaw that may allow authenticated privilege escalation.

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access...

CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers

Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forger...

CVE-2026-64649

Next.js SSRF vulnerability CVE-2026-64649 affects Next.js versions 14.1.1–15.5.20 and 16.0.0–16.2.10 when a Server Action forwards or redirects a request. An attacker who can control Host-related headers can cause the server to send outbound requests to a malicious host, via Server Actions on cus...

CVE-2026-42017

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions...

CVE-2026-42017

Technical details (affected products/versions, root cause, exploitability) are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-16481 Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

CVE-2026-17531

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17529

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astrmainagent.py. The manipulation of the argument req.functool leads to incorrect authorization. The attack may be initiated remotely. The exploit is publicly available an...

CVE-2026-17530

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function buildhandofftoolset of the file AstrBot/astrbot/core/astragenttoolexec.py of the component Subagent. The manipulation results in incorrect authorization. The attack may be...

CVE-2026-17531 unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17531

CVE-2026-17531 affects unitedbyai droidclaw up to version 0.5.3. The vulnerability is in an unspecified aspect of file server/src/routes/goals.ts (Unsigned Scheduled Callback) and enables authorization bypass. Remote exploitation is possible, with high complexity and a PROOF-OF-CONCEPT exploit pu...

CVE-2026-17531

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

EUVD-2026-49374

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...

CVE-2026-17531 unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote exploitation of the attack is possibl...