Linux Distros Unpatched Vulnerability : CVE-2026-54284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten...

PT-2026-77180

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

PT-2026-76901

Name of the Vulnerable Software and Affected Versions EricLBuehler Mistral.rs versions prior to 0.8.23 Description A remote out-of-bounds read can occur within the GGUF Tokenizer component. The issue exists in the convert gguf to hf tokenizer function located in the mistralrs-core/src/gguf/gguf...

Exposure Of Sensitive Authentication Credentials

New API is vulnerable to exposure of sensitive authentication credentials. The vulnerability is due to the admin user and user lookup APIs exposing User.AccessToken as accesstoken, which allows an authenticated administrator to obtain the root user's bearer token and use it to access root-only...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-56677

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

CVE-2026-71424

CVE-2026-71424 is a critical cross-user OAuth token leak in Onyx , an open-source AI platform. The GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header. The root cause is that OnyxTokenStorage.set_tokens and OnyxTokenStorage...

EUVD-2026-60479

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-71424 Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-71424 Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-75479

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full repor...

CVE-2026-75481

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users...

EUVD-2026-60471

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

CVE-2026-68765

hashcat master builds after v7.1.2 have a heap buffer overflow in module 34301 (KeePass AESKDF/KDBX v4): the ninth token field accepts 600 hex chars but decodes into a fixed 256-byte buffer without length checks, writing up to 44 bytes past the boundary into adjacent esalt fields and heap metadat...

CVE-2026-68765 hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module module 34301 that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the nint...

CVE-2026-68765 hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module module 34301 that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the nint...

CVE-2026-75481 SkyPilot Authentication Bypass via Service Account Role Escalation

SkyPilot fails to validate that authenticated users are entitled to grant administrator roles when updating service account permissions. Attackers can create a service account, escalate it to administrator role, and authenticate with its bearer token to gain administrative control over all users...