mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete Summary All HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An...

GHSA-84HP-MQVJ-3P8H mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete

Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete Summary All HTTP routes under /api/documents/ in mcp-memory-service are served without any authentication dependency, even when the server is configured with an API key MCPAPIKEY or OAuth. An...

ThreatsDay: AI Compute Hijacking, Apple Email Flaw, BlueHammer Ransomware + 14 Stories

This week’s security news is mostly about weak spots. Browsers, bots, sandboxes, AI systems, and email flows all show the same problem in different ways. Everything looks normal until someone tests a small gap and finds a way through. This is not one big break. It is small permissions, weak check...

GHSA-9R4W-JG96-92MV vulnerabilities

Vulnerabilities for packages: teleport, tbot, teleport-operator-fips...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: crossplane, kubescape-operator-fips, kube-arangodb, zarf-fips, k8ssandra-client, ocm-kubernetes-controller, cloudbeat-fips, ocm-kubernetes-controller-fips, headlamp, kube-mgmt-fips, kgateway-fips, falcoctl, helm-exporter-fips, chartmuseum-fips, helm-push,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: crossplane, kubescape-operator-fips, kube-arangodb, zarf-fips, k8ssandra-client, ocm-kubernetes-controller, cloudbeat-fips, ocm-kubernetes-controller-fips, headlamp, kube-mgmt-fips, kgateway-fips, falcoctl, helm-exporter-fips, chartmuseum-fips, helm-push,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: crossplane, kubescape-operator-fips, kube-arangodb, zarf-fips, k8ssandra-client, ocm-kubernetes-controller, cloudbeat-fips, ocm-kubernetes-controller-fips, headlamp, kube-mgmt-fips, kgateway-fips, falcoctl, helm-exporter-fips, chartmuseum-fips, helm-push,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: crossplane, kubescape-operator-fips, kube-arangodb, zarf-fips, k8ssandra-client, ocm-kubernetes-controller, cloudbeat-fips, ocm-kubernetes-controller-fips, headlamp, kube-mgmt-fips, kgateway-fips, falcoctl, helm-exporter-fips, chartmuseum-fips, helm-push,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: crossplane, kubescape-operator-fips, kube-arangodb, zarf-fips, k8ssandra-client, ocm-kubernetes-controller, cloudbeat-fips, ocm-kubernetes-controller-fips, headlamp, kube-mgmt-fips, kgateway-fips, falcoctl, helm-exporter-fips, chartmuseum-fips, helm-push,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: crossplane, kubescape-operator-fips, kube-arangodb, zarf-fips, k8ssandra-client, ocm-kubernetes-controller, cloudbeat-fips, ocm-kubernetes-controller-fips, headlamp, kube-mgmt-fips, kgateway-fips, falcoctl, helm-exporter-fips, chartmuseum-fips, helm-push,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: crossplane, kubescape-operator-fips, kube-arangodb, zarf-fips, k8ssandra-client, ocm-kubernetes-controller, cloudbeat-fips, ocm-kubernetes-controller-fips, headlamp, kube-mgmt-fips, kgateway-fips, falcoctl, helm-exporter-fips, chartmuseum-fips, helm-push,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: tigera-operator, gogatekeeper, helm-operator, rancher-agent, zarf, manifest-tool, k9s, opentofu, cluster-api-helm-controller, oras, rancher-helm, steampipe, tw, falcoctl, argocd-image-updater, argo-cd, kots, kubescape-operator, maru, teleport, helm-set-status,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: tigera-operator, gogatekeeper, helm-operator, rancher-agent, zarf, manifest-tool, k9s, opentofu, cluster-api-helm-controller, oras, rancher-helm, steampipe, tw, falcoctl, argocd-image-updater, argo-cd, kots, kubescape-operator, maru, teleport, helm-set-status,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: tigera-operator, gogatekeeper, helm-operator, rancher-agent, zarf, manifest-tool, k9s, opentofu, cluster-api-helm-controller, oras, rancher-helm, steampipe, tw, falcoctl, argocd-image-updater, argo-cd, kots, kubescape-operator, maru, teleport, helm-set-status,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: tigera-operator, gogatekeeper, helm-operator, rancher-agent, zarf, manifest-tool, k9s, opentofu, cluster-api-helm-controller, oras, rancher-helm, steampipe, tw, falcoctl, argocd-image-updater, argo-cd, kots, kubescape-operator, maru, teleport, helm-set-status,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: tigera-operator, gogatekeeper, helm-operator, rancher-agent, zarf, manifest-tool, k9s, opentofu, cluster-api-helm-controller, oras, rancher-helm, steampipe, tw, falcoctl, argocd-image-updater, argo-cd, kots, kubescape-operator, maru, teleport, helm-set-status,...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: tigera-operator, gogatekeeper, helm-operator, rancher-agent, zarf, manifest-tool, k9s, opentofu, cluster-api-helm-controller, oras, rancher-helm, steampipe, tw, falcoctl, argocd-image-updater, k8sgpt, argo-cd, kots, kubescape-operator, maru, teleport, helm-set-status...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: tigera-operator, gogatekeeper, helm-operator, rancher-agent, zarf, manifest-tool, k9s, opentofu, cluster-api-helm-controller, oras, rancher-helm, steampipe, tw, falcoctl, argocd-image-updater, k8sgpt, argo-cd, kots, kubescape-operator, maru, teleport, helm-set-status...

MAL-2026-6726 Malicious code in db-convertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7480b95a12688a84f3efd3d4c5c8a82c5c761f1f462eb22201f4385fb9bf691c index.js defines a method queryDBConnect on the exported DivbloxDatabaseConnector class that base64-decodes a hardcoded constant HASHKEY to the URL...

Malicious code in db-convertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7480b95a12688a84f3efd3d4c5c8a82c5c761f1f462eb22201f4385fb9bf691c index.js defines a method queryDBConnect on the exported DivbloxDatabaseConnector class that base64-decodes a hardcoded constant HASHKEY to the URL...