CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-72680

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

Kibana 9.4.5 Security Update (ESA-2026-82)

Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not...

PT-2026-71790

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-48039

CVE-2026-48039 : In Meta Ads MCP, versions before 1.0.109 suffer an authentication bypass where AuthInjectionMiddleware.dispatch() forwards unauthenticated /mcp requests to tool handlers, and when no per-request credential exists, falls back to META_ACCESS_TOKEN. The downstream Graph API error pa...

MAL-2026-12323 Malicious code in @nasddatax/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf5662d7c8759acd7a9a541baddd3bf4787594fafcd38f8a4eaf27bbe57d558 build/index.js appends an evalatob... trailer after legitimate re-exports. On require, the decoded loader queries public Ethereum JSON-RPC endpoints...

Malicious code in @rentwise/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47 build/index.js appends an evalatob... blob to the legitimate common-library exports, so the payload runs whenever any consumer requires...

CVE-2026-54418

CVE-2026-54418 affects Leantime up to version 3.6.2. The JSON-RPC endpoints leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA accept a caller-supplied userId without ownership checks, session pinning, or permission-attribute gating. An authenticated user can call ...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the import process. An attacker can access internal resources or read arbitrary files from the server filesystem by submitting crafted filenames containing URL wrappers or path traversal sequences...

CVE-2026-66415 Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

CVE-2026-66415 Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

CVE-2026-66415 Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

CVE-2026-66415

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

CVE-2026-66415

Leantime 3.6.2 is affected by a Server-Side Request Forgery (SSRF) and Local File Inclusion (LFI) vulnerability in Blueprints::import(). An authenticated attacker can pass unsanitized user-supplied filenames to file_get_contents(), without path validation, to read internal resources. Attacks can ...

PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

CVE-2026-67432

CVE-2026-67432 affects the MCP Ruby SDK before version 0.23.0. The vulnerability exists in MCP::Server::Transports::StreamableHTTPTransport of the mcp gem, which reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust memory on th...

CVE-2026-67432

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67432 MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-66412

Leantime vulnerability CVE-2026-66412 affects all versions prior to 3.6.2. A broken access control flaw in the tickets.getMilestone JSON-RPC endpoint allows authenticated users to read milestone data from projects they aren’t assigned to by supplying arbitrary integer milestone IDs. Attackers can...