CVE-2026-59708

The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio information including holdings,...

CVE-2025-56404

A security vulnerability exists in MariaDB MCP version 0.1.0 , an open-source server implementation of the Large Language Model Context Protocol for MariaDB. The flaw stems from insufficient validation of input data and a lack of user authentication within the SSE service . This allows a remote a...

CVE-2024-22513

djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the foruser method...