CVE-2026-0112

In vpuopeninst of vpuioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-27826

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL b...

MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

Summary An unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an Authorization header. No authentication is required. The...

CVE-2026-27826

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL b...

CVE-2026-25604

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, cluster-autoscaler, containerd, bank-vaults, cloud-sql-proxy, kserve, prometheus, cloudflared, crossplane-provider-aws-cloudformation, sftpgo-plugin-auth, kube-state-metrics, atlantis, cluster-api-provider-vsphere, ingress-nginx-controller,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, cluster-autoscaler, containerd, bank-vaults, cloud-sql-proxy, kserve, prometheus, cloudflared, crossplane-provider-aws-cloudformation, sftpgo-plugin-auth, kube-state-metrics, atlantis, cluster-api-provider-vsphere, ingress-nginx-controller,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: pdfcpu, prometheus, crossplane-provider-aws-cloudformation, kube-state-metrics, cluster-api-provider-vsphere, aws-application-networking-k8s, sbomqs, spire-controller-manager, undock, spicedb, rabbitmq-cluster-operator, step, nri-couchbase, thanos-operator,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: pdfcpu, prometheus, crossplane-provider-aws-cloudformation, kube-state-metrics, cluster-api-provider-vsphere, aws-application-networking-k8s, sbomqs, spire-controller-manager, undock, spicedb, rabbitmq-cluster-operator, step, nri-couchbase, thanos-operator,...

EUVD-2026-10318

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

EUVD-2026-10319

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604

CVE-2026-25604 affects Apache Airflow with the AWS Auth Manager: the code uses the client-supplied Host header to build the SAML ACS URL, bypassing validation against the configured instance URL. This enables potential cross-instance SAML token reuse and unauthorized access if a malicious Host he...

CVE-2026-25604 Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604 Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

PT-2026-24054

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 9.22.0 Description The AWS Auth Manager in Apache Airflow did not verify the origin of SAML authentication against the actual instance URL, relying instead on information provided by the client. This allowed fo...

CVE-2026-29067 ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login

ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password rese...

CVE-2026-29067 ZITADEL: Account Takeover Due to Improper Instance Validation in V2 Login

ZITADEL is an open source identity management platform. From version 4.0.0-rc.1 to 4.7.0, a potential vulnerability exists in ZITADEL's password reset mechanism in login V2. ZITADEL utilizes the Forwarded or X-Forwarded-Host header from incoming requests to construct the URL for the password rese...

CVE-2026-28680

CVE-2026-28680 affects Ghostfolio before version 2.245.0. An attacker can abuse the manual asset import feature to perform a full-read SSRF, enabling exfiltration of sensitive cloud metadata (IMDS) and the ability to probe internal network services. The vulnerability exhibits high confidentiality...