GHSA-HVRP-RF83-W775 vulnerabilities

Vulnerabilities for packages: semgrep...

CVE-2026-14541

The CVE concerns Google mcp-toolbox version 1.4.0 in its Google OAuth provider component. If an authService is initialized with mcpEnabled: true but without an explicit audience or clientId, the ValidateMCPAuth pipeline for opaque tokens omits audience validation. This causes the toolbox to accep...

ECHO-0EA6-9825-F478

Bulletin has no description...

OPENSUSE-SU-2026:11410-1 cf-cli-8.18.4+git.0.3fcd823a1-1.1 on GA media

These are all security issues fixed in the cf-cli-8.18.4+git.0.3fcd823a1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-61893

The CVE-2026-61893 entry concerns the MZ Automation lib60870 library. A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer, indicating an out-of-bounds read in...

ECHO-81DC-CE3A-8510

Bulletin has no description...

ECHO-96FB-2D4B-2D17

Bulletin has no description...

ECHO-84D4-4C4E-BD16

Bulletin has no description...

ECHO-9C14-687D-5BF7

Bulletin has no description...

ECHO-C3E5-5E37-B99F

Bulletin has no description...

ECHO-CC9A-82CA-85AB

Bulletin has no description...

ECHO-1A9A-3A4D-D022

Bulletin has no description...

ECHO-2A2D-1197-24DC

Bulletin has no description...

ECHO-225E-8CDA-8E05

Bulletin has no description...

ECHO-2E74-F33A-4982

Bulletin has no description...

ECHO-951A-8151-48FF

Bulletin has no description...

ECHO-8F3B-424E-5489

Bulletin has no description...

ECHO-CC19-7F4A-D6BB

Bulletin has no description...

ECHO-D290-6F63-5BEF

Bulletin has no description...

CVE-2026-68500

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...