CVE-2026-54689

CVE-2026-54689 affects mcp-searxng , a Model Context Protocol (MCP) server providing AI assistants with web search and URL-reading via SearXNG. The vulnerability lies in the hardened-mode SSRF protection in src/url-reader.ts: when MCP_HTTP_HARDEN is enabled and private URLs are not explicitly all...

CVE-2026-58196

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP...

CVE-2026-79551-Tenda

CVE-2026-79551 Clave privada TLS embebida en Tenda ID de CNVD: CNVD-2026-25884 Fabricante: Tenda Technology Co., Ltd. Producto: Grabador de video en red NVR4H versión de hardware CH3V2.1 Firmware: V27.5.58.6 Clase: CWE-321 — Uso de clave criptográfica embebida Descripción general El firmware del...

CVE-2026-46395-haxcms-hmac-key-leak

CVE-2026-46395 - Divulgación de clave privada en HAXcms Node.js mediante HMAC defectuoso CWE-321 / CWE-200 Prueba de concepto únicamente para pruebas de seguridad e investigación autorizadas. La vulnerabilidad descrita aquí está corregida en la última versión de HAXcms. Este PoC se publica para q...

CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-47426 OpenAM OAuth Client Impersonation via JWKS Resolver Cache

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

CVE-2026-81320

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-0101-BLE-Address-Spoofing-via-Weak-Resolvable-Private-Address

CVE-2026-0101 – Suplantación de dirección BLE mediante dirección privada resoluble débil Código del programa Python usando simulación bleak root@kitploit: bleperipheralsim.py - Simulated BLE peripheral with weak RPA verification import asyncio, random, hashlib from bleak import BleakServer,...

EUVD-2026-78276

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-81320 Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-81320

hawtio-operator (used in the OpenShift ecosystem) leaks the TLS private key in PEM format when a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher . The entire Route object is serialized to JSON and written to the operator's standard output, which is typic...

CVE-2026-81320

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-91181

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 Fail to sanitize Team objects returned by the data retention teams endpoint which allows an authenticated user holding only the read-only Data Retention Policy permission to obtain a private team's secret...

CVE-2026-65352

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

EUVD-2026-78003

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website may be able to determine a user's IP address with Private Relay turned on...

CVE-2026-65355

CVE-2026-65355 is an information disclosure vulnerability in Apple Private Relay , where improper state management allowed a website to determine a user's real IP address even with Private Relay enabled. The issue is rated CVSS 4.3 (Medium) with required user interaction and low confidentiality i...

CVE-2026-65352

CVE-2026-65352 is an information disclosure flaw in Apple's Private Relay feature, where a website may be able to determine a user's IP address even with Private Relay enabled. The issue was addressed with improved state management . Fixed versions: iOS 26.6.1 , iPadOS 26.6.1 , macOS Tahoe 26.6.2...