EUVD-2026-120540

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

CVE-2026-125377

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

CVE-2026-125377: pig-mesh pig: Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users…

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

CVE-2026-125377 Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

CVE-2026-125377

Pig versions prior to 4.1.2 are affected by a missing authorization vulnerability within the SysClientController . This flaw allows authenticated users who lack specific client-management permissions to retrieve sensitive OAuth2 client secrets through the GET /client/{clientId} and GET /client/ex...

CVE-2026-125377 Pig before 4.1.2 Missing Authorization Exposes OAuth2 Client Secrets via /client

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

PT-2026-141200

Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users without client-management permission to retrieve OAuth2 client secrets via GET /client/clientId and GET /client/export. Attackers can fetch clientSecret values for seed clients...

CVE-2026-124468

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens...

CVE-2026-124468

OpenEMR versions before 8.3.0 are vulnerable to an SQL injection vulnerability within the Standard REST API's patient insurance and employer search functions. The root cause is the improper concatenation of query-string parameter names into SQL statements as column identifiers without sufficient ...

CVE-2026-124468 OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens...

EUVD-2026-119524

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens...

PT-2026-139982

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens...

CVE-2026-103506

A flaw was found in Grafana. When the experimental Kubernetes Single Sign-On SSO settings Application Programming Interface API feature toggle is enabled, the service fails to enforce proper authorization checks. An authenticated user with low-privilege Viewer permissions can exploit this...

UBUNTU-CVE-2026-103506

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions missing authorization. This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is...

CVE-2026-103506: Improper Authorization

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions missing authorization. This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is...

CVE-2026-108716

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

EUVD-2026-96990

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

PT-2026-110119

Name of the Vulnerable Software and Affected Versions mcp-remote versions 0.8.0 through 0.14.3 Description The software contains a cleartext transmission issue within the authorizeWithDeviceCode function. This occurs when client secrets are sent and tokens are received without the enforcement of...

CVE-2026-107604

A flaw in the Keycloak identity management service allows a realm administrator with the read-only view-clients role to retrieve the active primary secret of any confidential client. This occurs via the installation provider and client registration endpoints. The exposed secret can be used to imp...