pentest-mcp

Pentest MCP Professional penetration-testing MCP server with modern transport/auth support and expanded recon tooling. What Changed in 0.9.0 Upgraded MCP SDK to @modelcontextprotocol/sdk@^1.26.0 Kept MCP Inspector at the latest release @modelcontextprotocol/inspector@^0.20.0 with bundled launcher...

CVE-2026-61833

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

Summary A bearer token with only pull and push scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the "push" action, and the DistSpecAuthzHandler middleware is bypassed entirely for...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

EUVD-2026-75174

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication...

CVE-2026-87015

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

PT-2026-89162

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.27 through 0.11.0 Description An issue exists in the tool loading routine within backend/open webui/utils/tools.py where a cookie jar is captured from the enclosing connection loop instead of being bound to each externa...

CVE-2026-77298 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-77298

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier , the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy . While the standard STS AssumeRoleWithWebIdentity ...

CVE-2026-77298 SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an external OIDC JWT sent directly in the Authorization header and maps it to an IAM role without enforcing that role's trust policy, so a federated user can assume a role they are not...

CVE-2026-58482

Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...

Malicious code in @thepayulink/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0f04014bd624dc0712b8bfb78c53832ef18bf6a178d462b1959df9a8b81ec94 The CommonJS bundle loaded by require'@thepayulink/server' dist/payulink-server.cjs hardcodes apiBase to https://eliteyatra.vip as the default...

CVE-2026-43585: Operation on a Resource after Expiration or Release

OpenClaw before 2026.4.15 captures resolved bearer-auth configuration at startup, allowing revoked tokens to remain valid after SecretRef rotation. Gateway HTTP and WebSocket handlers fail to re-resolve authentication per-request, enabling attackers to use rotated-out bearer tokens for unauthoriz...

GHSA-GQ3J-XVXP-8HRF Hono added timing comparison hardening in basicAuth and bearerAuth

Summary The basicAuth and bearerAuth middlewares previously used a comparison that was not fully timing-safe. The timingSafeEqual function used normal string equality === when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing...

CVE-2022-31142

@fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750,...

CVE-2019-16332

In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS...

fastify-bearer-auth vulnerable to Timing Attack Vector

Impact fastify-bearer-auth does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack...

fastify-bearer-auth (6.3.0-rc.1) potentially affected by CVE-2022-31142 via @fastify/bearer-auth (7.0.0-rc.1)

@fastify/bearer-auth NPM version 7.0.0-rc.1 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/bearer-auth and may be impacted: - fastify-bearer-auth 6.3.0-rc.1 Source cves: CVE-2022-31142 Source advisory: OSV:GHSA-376V-XGJX-7MFR...

GHSA-376V-XGJX-7MFR fastify-bearer-auth vulnerable to Timing Attack Vector

Impact fastify-bearer-auth does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack...