EUVD-2026-58753

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

CVE-2026-48528 Metacat has an unauthenticated SQL injection vulnerability

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

CVE-2026-48528

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

CVE-2026-48528 Metacat has an unauthenticated SQL injection vulnerability

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input that can be passed...

CVE-2026-48528

CVE-2026-48528 affects Metacat versions 2.0.0–3.4.0 and describes an unauthenticated SQL injection in the /cn/v1/object and /cn/v2/object REST endpoints due to unsanitized nodeId input. The backend SQL queries concatenate user input, enabling arbitrary data extraction from PostgreSQL and potentia...

CVE-2026-46405

A flaw was found in OpenBao, an identity-based secrets management system. When the Kerberos authentication method processes a GET request or an Authorization: Negotiate header, it inadvertently creates authentication tokens that are not accessible to the caller and are hidden by an error message...

CVE-2026-19636

The CVE-2026-19636 issue concerns CSRF token generation using a predictable method. The connected documents confirm a fix that increases randomness and entropy in token generation, addressing the vulnerability. The description does not specify affected products, versions, or exploit details. The ...

CVE-2026-19636 Insuffucient Protections Lead to Brute Force

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

CVE-2026-19636

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

EUVD-2026-58736

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

CVE-2026-19636 Insuffucient Protections Lead to Brute Force

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

cynative v1.9.2

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning through GitHub, GitLab,...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-46380

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

EUVD-2026-58731

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 is affected by an authenticated reflected XSS in the HTML editor popup endpoint. The vulnerability arises because the text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding, enabling ...