CVE-2026-49257 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

mcp-pinot is a Python-based Model Context Protocol MCP server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and...

CVE-2025-59022 TYPO3 CMS Allows Broken Access Control in Recycler Module

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website...

CVE-2025-59022

CVE-2025-59022 affects TYPO3 CMS: back-end users with Recycler Module access can delete arbitrary data from any TCA-defined table, bypassing permissions and potentially rendering sites unavailable. Affected versions include 10.0.0–10.4.54, 11.0.0–11.5.48, 12.0.0–12.4.40, 13.0.0–13.4.22, and 14.0....

TYPO3 Remote Privilege Bypass Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. A privilege bypass vulnerability exists in TYPO3 Table Configuration Queue TCA, which can be exploited by remote attackers to bypass authentication and perform unauthorized...