CVE-2026-66006

lakeFS

CVE-2026-66006 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

PT-2026-64319

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.83.0 commit 71a45ee Description An authentication bypass exists in the '/setup comm prefs' endpoint. This allows unauthenticated attackers to overwrite operator metadata, such as email, name, and company, after the...

PT-2026-71710

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 6.13.10 Mongoose versions prior to 7.8.10 Mongoose versions prior to 8.24.1 Mongoose versions prior to 9.7.2 Description Passing user-controlled updates to functions like updateOnefilter, req.body can lead to prototy...

CVE-2026-66006: Missing Authentication for Critical Function

lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setupcommprefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to...

EUVD-2026-48426

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724

Nebula-Mesh (pre-0.3.4) suffers an authorization gap: the /api/v1/* surface largely trusts bearer tokens and enforces ownership only for the Web layer, leaving host, network, firewall, mobile-bundle, and most operator endpoints vulnerable to cross-tenant access. This enables privilege escalation ...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

CVE-2026-47724 nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the /api/v1/ route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at internal/api/hosts.go:384: "API trusts the bearer toke...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, ctop, k3s, kine, flux-source-controller, gh, telegraf, pgtimetable, timoni, aws-nuke, sftpgo-plugin-geoipfilter, pguser, kube-fluentd-operator, cerbos, syft, pulumi-language-java, k8s-device-plugin, kustomize, helm-operator, containerd,...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, ctop, k3s, kine, flux-source-controller, gh, telegraf, pgtimetable, timoni, aws-nuke, sftpgo-plugin-geoipfilter, pguser, kube-fluentd-operator, cerbos, syft, pulumi-language-java, k8s-device-plugin, kustomize, helm-operator, containerd,...

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token SummaryAuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...

PYSEC-2026-3484 meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent. Because extracttokenfromheaders does not recognise the X-Pipeboard-Token header, an attacker who sends...

CVE-2026-46600 vulnerabilities

Vulnerabilities for packages: gobgp, terraform-provider-azurerm-fips, sftpgo-plugin-geoipfilter, image-factory, mediamtx, rollouts-plugin-trafficrouter-gatewayapi, virt-operator, gitlab-runner-fips, prometheus-operator, sftpgo, longhorn-instance-manager, opentelemetry-collector-contrib, bento,...

GHSA-GG3M-VVP2-P2C5 vulnerabilities

Vulnerabilities for packages: gobgp, terraform-provider-azurerm-fips, sftpgo-plugin-geoipfilter, image-factory, mediamtx, rollouts-plugin-trafficrouter-gatewayapi, virt-operator, gitlab-runner-fips, prometheus-operator, sftpgo, longhorn-instance-manager, opentelemetry-collector-contrib, bento,...

PT-2026-64094

X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token Summary AuthInjectionMiddleware in meta-ads-mcp rejects HTTP MCP requests only when both auth token and pipeboard token are absent. Because extract token from headers does not recognise the X-Pipeboard-Token header, an attacker who...

CVE-2026-13065

A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort...

Security Bulletin: IBM Event Endpoint Management is affected by multiple vulnerabilities.

Summary IBM Event Endpoint Management is affected by multiple vulnerabilities. These are affecting the operator and frontend components. Vulnerability Details CVEID:CVE-2026-31988 DESCRIPTION: yauzl aka Yet Another Unzip Library version 3.2.0 for Node.js contains an off-by-one error in the NTFS...

CVE-2026-50243 'response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

EUVD-2026-46931

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: NDB Operator. Supported versions that are affected are 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Cluster...