CVE-2026-73653 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse...

GO-2026-6179 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, langfuse, spire-server, kots, zot, k3d, containerd, k8s-device-plugin, commercial-grafana, kyverno, langfuse-fips, snyk-cli, reports-server, falco-no-driver, terraform, k3s, aactl...

GO-2026-6180 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, langfuse, spire-server, kots, zot, k3d, containerd, k8s-device-plugin, commercial-grafana, kyverno, langfuse-fips, snyk-cli, reports-server, falco-no-driver, terraform, k3s, aactl...

CVE-2026-56865 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, langfuse, spire-server, kots, zot, k3d, containerd, k8s-device-plugin, commercial-grafana, kyverno, langfuse-fips, snyk-cli, reports-server, falco-no-driver, terraform, k3s, aactl...

CVE-2026-56864 vulnerabilities

Vulnerabilities for packages: nerdctl, prometheus-mongodb-exporter, langfuse, spire-server, kots, zot, k3d, containerd, k8s-device-plugin, commercial-grafana, kyverno, langfuse-fips, snyk-cli, reports-server, falco-no-driver, terraform, k3s, aactl...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: homepage, jitsucom-jitsu, langfuse, pelias-api, authentik-fips, semaphore, unleash, nextcloud-server, langfuse-fips, cadence-web, arangodb, librechat, keep-fips, vitess, unleash-fips, keep, authentik...

CVE-2026-73646 vulnerabilities

Vulnerabilities for packages: langfuse, jitsucom-jitsu, nextcloud-server, vitess...

CVE-2026-49457

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73844

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...

CVE-2026-73845

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...

CVE-2026-49826

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

SUSE CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73846

The CVE describes a vulnerability in CKAN MCP Server prior to version 0.4.112 where canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters. This causes different logical parameter sets used by buildCacheKey to coll...

CVE-2026-73846

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

EUVD-2026-58727

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...

CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...

CVE-2026-73845

CKAN MCP Server before v0.4.112 is affected by an allowlist bypass in the isValidMqaServer check within the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools (src/tools/quality.ts). The prefix-only regex for dati.gov.it allows suffix-host and URL-userinfo values to target an attacker-co...