CVE-2026-81846 runZero MCP 'Findings summaries' Data Leak

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

CVE-2026-81846 runZero MCP 'Findings summaries' Data Leak

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

Kibana 8.19.21, 9.4.6 Security Update (ESA-2026-155)

Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

EUVD-2026-69418

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551

Amazon SageMaker Python SDK versions prior to v3.11.0 and v2.256.0 store the HMAC signing key in cleartext within the @step and @remote decorator pipeline component. This allows an authenticated remote user to extract the key from SageMaker DescribePipeline API responses and forge valid integrity...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

CVE-2020-7494

creationtimestamp| type| source ---|---|--- 2026-09-01 17:01:12+00:00| seen| https://t.me/cissp/1528 2026-09-02 01:05:01+00:00| seen| https://t.me/cissp/1528 2026-09-12 01:00:05+00:00| published-proof-of-concept| https://t.me/cissp/1528 2026-09-13 00:01:01+00:00| published-proof-of-concept|...

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

CVE-2026-84205

GROWI through 8.0.2 contains an authorization bypass in the GET /_api/v3/revisions/:id endpoint. The vulnerability arises because the endpoint validates access using a query parameter but returns the revision identified by the path parameter without confirming both reference the same page. An aut...

Exploit for CVE-2026-82329

CVE-2026-82329 — JFrog Artifactory unauthenticated auth bypass...

Malicious code in react-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3486f0a140ab65c516d0261fefbe67384d5a604715ee6faa7da5591ab456b906 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

SUSE CVE-2026-79780

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-53682

Dogtag PKI (pki-core) exposes the Security Domain hosts inventory via the REST endpoint GET /ca/rest/securityDomain/hosts without requiring authentication (no principal, client certificate, or session). An unauthenticated client can receive a structured response enumerating internal PKI/CA hosts ...

CVE-2026-18654

A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce EMR Secure Shell SSH helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions...

Attackers Steal METR API Key and Consume AI Credits Worth About $600,000

METR short for Model Evaluation and Threat Research and pronounced "Meter", a research non-profit that evaluates frontier artificial intelligence AI models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors...

kernel: crypto: qat - validate RSA CRT component lengths

A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...

CVE-2026-80708

A flaw was found in the Linux kernel's s390/zcrypt module. During the clear key to secure key token import process, an internal buffer used by the ipcprbhelper function was not properly scrubbed after use. This oversight could leave sensitive clear key material in memory. A local attacker could...