CVE-2026-50143: Server-Side Request Forgery (SSRF)

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-62684: Exposure of Sensitive Information to an Unauthorized Actor

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

CVE-2026-23922: Insufficiently Protected Credentials

The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint...

PT-2026-80427

S3 session token leakage on HTTPS to HTTP redirect in github.com/rclone/rclone...

PT-2026-80446

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" such as evil.azurecr.io.attacker.com are treated ...

PT-2026-80364

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions in github.com/pocket-id/pocket-id/backend...

PT-2026-77180

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

PT-2026-76955

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A Super Admin can leak the Client secret of the email media OAuth field by configuring a malicious Token endpoint. This occurs because the Client secret is not...

Linux Distros Unpatched Vulnerability : CVE-2026-54284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten...

PT-2026-80401

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API in github.com/bank-vaults/vault-secrets-webhook...

PT-2026-80457

New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...

PT-2026-77167

Name of the Vulnerable Software and Affected Versions AAP Controller affected versions not specified Description A flaw exists in the HashiCorp Vault credential plugin of the AAP Controller. When a HashiCorp Vault Secret Lookup credential using kubernetes role authentication is tested, the...

PT-2026-77267

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback messagemessage is stored without sanitization and rendered in app/views/admin/feedback messages/ feedback message.html.erb throu...

PT-2026-80350

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored in github.com/cloudreve/Cloudreve...

TENET: Telegram Mini App (In)Security

Telegram, with over 450 million daily active users, has introduced Mini Apps---web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials---such as session tokens and wall...

PT-2026-80362

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method in github.com/pocket-id/pocket-id/backend...

PT-2026-76901

Name of the Vulnerable Software and Affected Versions EricLBuehler Mistral.rs versions prior to 0.8.23 Description A remote out-of-bounds read can occur within the GGUF Tokenizer component. The issue exists in the convert gguf to hf tokenizer function located in the mistralrs-core/src/gguf/gguf...

Linux Distros Unpatched Vulnerability : CVE-2026-75010

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a...

Exposure Of Sensitive Authentication Credentials

New API is vulnerable to exposure of sensitive authentication credentials. The vulnerability is due to the admin user and user lookup APIs exposing User.AccessToken as accesstoken, which allows an authenticated administrator to obtain the root user's bearer token and use it to access root-only...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...