445 matches found
Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure
Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts,...
Homarr < 1.54.0 - Information Disclosure
Homarr 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication. id: CVE-2026-27796 info: name: Homarr 1.54.0 - Information...
Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion
Joomla! Jtag Members Directory 5.3.7 is vulnerable to local file inclusion via the downloadfile parameter. id: CVE-2018-6008 info: name: Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion author: daffainfo severity: high description: Joomla! Jtag Members Directory 5.3.7 is vulnerable to...
GHSA-RR55-JP92-8WP2 claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools
Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...
claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools
Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...
faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools
Summary faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to...
grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools
Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...
GHSA-CC2G-GQ8C-R332 grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools
Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...
Security Bulletin: TSSC/IMC addresses multiple security vulnerabilities.
Summary TSSC/IMC addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2026-22007 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Java SE executes to compromise Java SE...
Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-87)
Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet...
CVE-2026-59503
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...
CVE-2026-59499
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...
CVE-2026-59507
Technical details about CVE-2026-59507 are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-57774
CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control...
CVE-2026-59503
CVE-2026-59503 describes exposure of sensitive information to an unauthorized actor with a CVSS v3.1 base score of 9.1 (CRITICAL). The attack vector is NETWORK with no privileges required and no user interaction, and it impacts confidentiality and integrity (both HIGH) while availability remains ...
CVE-2026-59503 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...
EUVD-2026-57770
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...
CVE-2026-59503
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...