CVE-2026-81100: Origin Validation Error

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-59297: Origin Validation Error

Implementation of isSecure call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-81099: Origin Validation Error

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

ROS-20260827-73-0011

The vulnerability of the bondxmithash function in the drivers/net/bonding/bondmain.c file of the Linux kernel’s network device driver is related to a data processing error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

ROS-20260827-73-0031

The vulnerability in the kernel-lt is related to a memory rerelease error. Exploiting this vulnerability can allow an attacker to cause a service failure...

Security update for dracut (important)

openSUSE security update: security update for dracut ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21639-1 Rating: important References: bsc1274432 Cross-References: CVE-2026-15816 CVSS scores: CVE-2026-15816 SUSE : 7.5...

Security update for xmlrpc-c (moderate)

openSUSE security update: security update for xmlrpc-c ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21633-1 Rating: moderate References: bsc1272769 Cross-References: CVE-2026-15928 CVSS scores: CVE-2026-15928 SUSE : 5.4...

CVE-2026-81092: Origin Validation Error

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81102: Origin Validation Error

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81676: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

PT-2026-82498

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limit videos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-75159: Double Free

An unauthenticated client that can reach a MongoDB Connector for BI deployment configured with Kerberos authentication may cause mongosqld to terminate when a crafted authentication exchange encounters a specific GSSAPI error-handling condition. This can interrupt BI Connector availability until...

CVE-2026-81095: Origin Validation Error

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

PT-2026-82496

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

PT-2026-82800

Name of the Vulnerable Software and Affected Versions jwcrypto affected versions not specified Description A flaw allows a remote attacker to cause a denial of service DoS by sending a specially crafted JSON Web Encryption JWE token containing numerous period delimiters. This malformed token forc...

CVE-2026-81675: Improper Neutralization of Special Elements used in an SQL Command

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

PT-2026-82549

Name of the Vulnerable Software and Affected Versions MongoDB Connector for BI affected versions not specified Description An unauthenticated client capable of reaching a deployment configured with Kerberos authentication can cause the mongosqld process to terminate. This occurs when a crafted...

CVE-2026-21809

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input...

CVE-2026-21809 HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input...

CVE-2026-21809 HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input...