CVE-2026-61559: Server-Side Request Forgery (SSRF)

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

CVE-2026-47426: Improper Authentication

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the privatekeyjwt client authentication path uses ClientJwksResolverCache without reliably binding a cached jwksuri resolver and verified assertion to the expected clientID in ClientCredentialsReader. An attacker...

PT-2026-93172

Name of the Vulnerable Software and Affected Versions @zereight/mcp-gitlab versions prior to 2.1.27 Description When the SSE transport mode is enabled via SSE=true, all Model Context Protocol MCP tools are exposed without authentication. This is the default configuration for Docker deployments. A...

CVE-2026-46498: Authorization Bypass Through User-Controlled Key

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core Token Store CTS without an OAuth-only namespace, and OAuthAdapter accepts a row whose BLOB claims to contain an OAuth token without binding...

CVE-2026-81921: Missing Authorization

Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...

CVE-2026-39039

The BharatMLStack software (up to and including v1.3.0 ) contains a vulnerability in the Trufflebox UI where it stores sensitive information in the browser's localStorage . Specifically, the JWT authentication token , full user object , and session ID are stored in a manner that makes them fully ...

PT-2026-92389

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

CVE-2026-18426: Missing Authorization

Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solely on CSRF token validation. Because the token is bound to the user and action rather than to a specific block, page, or form, an...

CVE-2026-39039: Improper Neutralization of Input During Web Page Generation

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

JFrog Artifactory < 7.133.11 Privilege Escalation

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.133.11. It is, therefore, affected by a privilege escalation vulnerability. - JFrog Artifactory Self Hosted versions before 7.133.11 are vulnerable to a privilege escalation...

PT-2026-92432

Name of the Vulnerable Software and Affected Versions SD-WAN Orchestrator affected versions not specified Description An authenticated remote attacker with read-only privileges can cause the exposure of sensitive configuration information by sending a specially crafted request to the cache...

CVE-2026-91201

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201

DocsGPT through 0.20.0 is affected by an OAuth token disclosure via a wildcard postMessage in the callback-status endpoint. Session tokens are posted without validating the sender origin, allowing an attacker acting as window.opener during the OAuth authorization flow to steal session tokens and ...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

GHSA-VRH8-C9CM-WH8V ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

EUVD-2026-42967

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange...

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...