CVE-2026-67431

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that...

CVE-2026-59883

A flaw was found in Guzzle, an extensible PHP HTTP client. The CookieJar component improperly handled cookies for IP-address or bare-numeric domains, failing to restrict them to the exact host. This vulnerability could allow a remote attacker to disclose cookies across different hosts, inject...

PT-2026-65898

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to bind a session ID to a session owner. This allows an attacker who has obtained a stolen session ID to send tools/ca...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

EUVD-2026-48311

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

VulnCheck KEV: CVE-2026-8496

A cross-site scripting XSS vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS...

Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p3rg-hrf9-w9gj. This link is maintained to preserve external references. Original Description n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in...

CVE-2026-56583

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

EUVD-2026-46346

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

CVE-2026-56583

Technical details are not publicly available in the provided documents. Monitor for updates from HCL and NVD to obtain affected versions, root cause, and remediation guidance.

CVE-2026-56583 HCL MyCloud was affected with Concurrent Login Vulnerability.

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

CVE-2026-28315

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account...

CVE-2026-64628

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious...

CVE-2026-63757

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...

CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...

EUVD-2026-45928

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...

CVE-2026-63757

CVE-2026-63757 affects SurrealDB versions before 3.1.0. The HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification, enabling unauthenticated attackers to enumerate session UUIDs and impersonate authentica...