CVE-2026-97662

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

SummaryENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

CVE-2026-82828

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-82825

The Hitachi Coding Software Suite (versions through 3.3.0) is vulnerable to a Missing Authentication for Critical Function flaw. This vulnerability allows an unauthenticated attacker to invoke a critical API, which may lead to the unauthorized retrieval or alteration of sensitive information, or ...

CVE-2026-82825 Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrieval or alteration of sensitive information, or unauthorized manipulation. Thi...

EUVD-2026-90491

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-82828 Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-82828 Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CLEANSTART-2026-KF94035 Out-of-bounds memory operations in org

Security vulnerability affects the apache-nifi package. Out-of-bounds memory operations in org...

CVE-2026-97662: Improper Neutralization of Argument Delimiters in a Command

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

PT-2026-103965

Name of the Vulnerable Software and Affected Versions AWS security-agent-mcp-server versions prior to 0.2.0 Description An argument injection issue exists in the diff scan operation. A threat actor can provide a crafted reference value to the diff scan operation to create, overwrite, or truncate...

PT-2026-103687

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perform administrator-level operations. This issue affects Hitachi Coding Software Suite: through 3.3.0...

PT-2026-104049

Name of the Vulnerable Software and Affected Versions infiniflow ragflow version 0.25.3 Description Improper access control exists in the resume function within the 'api/apps/connector app.py' endpoint. This flaw allows an attacker to execute unauthorized cross-session or privilege-crossing...

CVE-2026-51896

The software infiniflow ragflow version 0.25.3 is affected by a vulnerability involving improper access control in the resume function located within the api/apps/connector_app.py endpoint. This security flaw enables an attacker to perform unauthorized cross-session or privilege-crossing operatio...

CVE-2026-51895

Ragflow versions 0.24.0 and prior are affected by an improper access control vulnerability within the update_metadata_setting function located in api/apps/kb_app.py. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossing operations, depending on the specific expo...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51896

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51895: Improper Access Control

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-51896: Improper Access Control

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...