CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-63458

Perses , an open-source dashboard and visualization project for observability data, contains an authorization bypass on project-scoped list endpoints (e.g., /api/v1/projects/{project}/dashboards, /api/v1/datasources). An authenticated user with viewer access to one project can supply a different ...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-58197

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to...

GHSA-QG2G-G9W3-M5H8 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

Summary A containerized MCP server running with the default network permission profile insecureallowall: true can reach host-local services via host.docker.internal. This includes the ToolHive API itself, other ToolHive-managed MCP server proxies, and any other service listening on the host's...

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any authenticated tenant can inject their own X-Remote-Group and X-Remote-Extra- headers, which the shard trusts as a verified identity assertion — allowing a low-privilege user to...

SUSE CVE-2026-93379

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-58197 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to...

CVE-2026-58197 ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to...

CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

The vulnerability of the Container Isolation FS Filter driver for Windows operating systems allows a hacker to compromise the integrity of the protected information.

The vulnerability of the Container Isolation FS Filter driver for Windows operating systems is related to the incorrect handling of symbolic references before accessing a file. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

Linux Distros Unpatched Vulnerability : CVE-2026-93378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site...

CVE-2026-93604: Improper Access Control

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

ROS-20260918-73-0002

The vulnerability of the rdsconnshutdown function in the net/rds/connection.c module, which is part of the Linux kernel’s networking functions, is related to deficiencies in the isolation of the controlled system area. Exploiting this vulnerability could allow a malicious actor to cause service...

Linux Distros Unpatched Vulnerability : CVE-2026-93379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium...

CVE-2026-63458: Authorization Bypass Through User-Controlled Key

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-58197: Improper Access Control

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to...