EUVD-2026-61056

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in...

CVE-2026-52723

In ePA 3.x Integration versions prior to 1.3.0, app/vau/VAUProtokoll.py validates the VAU server certificate without anchoring it to independent trusted material, creating a circular trust relationship. Combined with disabled TLS certificate verification, a network-positioned attacker can interce...

CVE-2026-50576 ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration does not neutralize CRLF characters in values used by app/vau/VAUProtokoll.py to construct VAU inner HTTP requests. The...

GHSA-5M9F-RPHJ-C435 RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Vulnerability Summary com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate including null chains and is used as the default trust manager when calling ConnectionFactory.useSslProtocol without arguments. Combined with hostname verification being disabled by default, this...

RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Vulnerability Summary com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate including null chains and is used as the default trust manager when calling ConnectionFactory.useSslProtocol without arguments. Combined with hostname verification being disabled by default, this...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

EUVD-2026-61045

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol and ConnectionFactory.useSslProtocolString configure com.rabbitmq.client.TrustEverythingTrustManager and...

CVE-2026-75890

Duplicate of CVE-2026-50236. This CVE ID was reserved in error for a finding that already had an existing CVE assignment...

CVE-2026-75872

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

DEBIAN-CVE-2026-68939

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

ANT-2026-66X46XSC · supabase/supabase · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-66X46XSC: X-Content-Type-Options header set to invalid value The Next.js headers configuration for the Supabase...

ANT-2026-AM0R21ZY · supabase/supabase · broken-access-control

broken-access-control medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-AM0R21ZY: HIPAA sensitive-project AI block enforced only client-side The client hook...

CVE-2026-75872

In maalfer MailerUp before 1.1.3, the unauthenticated public subscription form interpolates the first_name field unescaped into the double opt-in verification email, letting remote attackers send arbitrary HTML from the form owner's configured sending identity to an attacker-chosen address. The v...

CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

EUVD-2026-60820

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...

EUVD-2026-60689

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74955 Privilege escalation in the Request Handling component

Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74945 Information disclosure in the Graphics: Text component

Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...