2017 matches found
CVE-2026-14541 Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...
CVE-2026-43714
The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data...
CVE-2026-43714
The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data...
EUVD-2026-49477
The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data...
ROS-20260724-73-0040
The vulnerability in ImageMagick relates to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
The vulnerability of the Microsoft .NET software platform and the Visual Studio Code editor, related to errors in handling symbolic links, allows attackers to gain unauthorized access to protected information.
The vulnerability of the Microsoft .NET software platform and the code editor Visual Studio Code is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
ROS-20260722-73-0019
The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created...
The vulnerability of the IOCTL dispatcher in the ASUS System Control Interface (ASCI) driver and the set of tools for managing and protecting corporate devices provided by ASUS Business Manager, which allows a malicious actor to disclose protected information or cause service failures.
The vulnerability of the IOCTL handler of the ASCI driver allows an attacker to exploit it to disclose protected information or cause service failures. This vulnerability is related to errors that occur during the update of the link counters. Exploiting this vulnerability could enable a remote...
CVE-2024-58367 SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions
SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function argument...
ROS-20260713-73-0026
The vulnerability of the tarfile module in the Python programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...
ROS-20260709-73-0028
The vulnerability in Portainer-Ce is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
ROS-20260708-73-0043
The vulnerability in ImageMagick 7 is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
ROS-20260708-73-0024
The vulnerability of the PostgreSQL database management system is related to the disclosure of information based on temporal discrepancies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...
Уязвимость компонента Dawn браузера Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Уязвимость компонента Dawn браузера Google Chrome связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации с помощью специально созданной HTML страницы...
Уязвимость компонента WebGPU браузера Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Уязвимость компонента WebGPU браузера Google Chrome связана с чтением за границами буфера. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации с помощью специально созданной...
The vulnerability of the wil_write_file_wmi() function in the drivers/net/wireless/ath/wil6210/debugfs.c file of the Atheros/Qualcomm wireless adapter driver for the Linux operating system allows a attacker to access protected information or cause a service failure.
The vulnerability of the wilwritefilewmi function in the drivers/net/wireless/ath/wil6210/debugfs.c file of the Atheros/Qualcomm wireless adapter driver for the Linux operating system involves the exposure of confidential information. Exploiting this vulnerability could allow an attacker to gain...
CVE-2026-56782 Gorse - Unauthenticated Database Dump and Restore via /api/dump and /api/restore Endpoints
Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when adminapikey is empty, which is the default configuration. Remote attackers can exfiltrate the entire databas...
The vulnerability of the command-line utility bin/solr auth for the Apache Solr search server allows a perpetrator to escalate their privileges and gain unauthorized access to protected information.
The vulnerability of the command-line utility bin/solr auth for the Apache Solr search server relates to the use of pre-installed user accounts. Exploiting this vulnerability allows an attacker to enhance their privileges and gain unauthorized access to protected information...
ROS-20260623-73-0033
The vulnerability of the FileLoader class in the CPython interpreter relates to the disclosure of information in the error-prone data area. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...