87616 matches found
CVE-2026-73844
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...
SUSE CVE-2026-68268
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Return error on non-migratable faults requiring devmem Non-migratable faults that require devmem incorrectly jump to the 'out' label, which squashes the error code intended to be returned to the upper layers. Fix this by...
CVE-2026-73844
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...
CVE-2026-73844
CKAN MCP Server prior to 0.4.112 is vulnerable to information disclosure via verbose error reflection. When the server is pointed at or redirected/SSRF’d to a non-CKAN host or when an internal exception occurs, the response may include raw upstream content, hostnames, internal IPs, DB errors, and...
CVE-2026-73844 CKAN MCP Server: Information disclosure via verbose error reflection
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...
CVE-2026-73844 CKAN MCP Server: Information disclosure via verbose error reflection
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...
CVE-2026-73844 CKAN MCP Server: Information disclosure via verbose error reflection
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...
CVE-2026-73555
A flaw was found in vLLM, an inference and serving engine for large language models. Unauthenticated attackers can send malformed JSON requests to various API endpoints, triggering validation errors. The system's error handling mechanism converts these validation errors into strings without...
dracut security update
An update is available for dracut. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The dracut packages contain an event-driven initial RAM file system initramfs...
RLSA-2026:54571 Important: dracut security update
The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...
GO-2025-3842 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector...
PT-2026-72065
Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112 Description Error paths reflect raw upstream response bodies and internal exception messages to the caller instead of using sanitized, generic messages. This occurs when the server is directed to a hos...
PT-2026-72081
Name of the Vulnerable Software and Affected Versions Metacat versions 2.0.0 through 3.4.0 Description Unauthenticated SQL injection exists in the /cn/v1/object and /cn/v2/object REST API endpoints. The issue occurs because the software appends user-supplied data to SQL queries without sanitizati...
AlmaLinux 10 : dracut (ALSA-2026:54576)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:54576 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the precedin...
RockyLinux 10 : dracut (RLSA-2026:54576)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54576 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the precedi...
CVE-2026-73421
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...
CVE-2026-73421 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...
CVE-2026-73421
NextAuth.js vulnerability CVE-2026-73421 affects next-auth v5: when server configuration has an error (e.g., missing issuer/authorization, unset AUTH_SECRET), the auth() wrapper can return a truthy error object in middleware, Route Handlers, React Server Components, etc. As a result, existence-ba...
CVE-2026-73421 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, applications that gate access by checking only for the existence of the auth object returned by the auth wrapper can fail open when Auth.js has a server configuration error. In middleware, Route...