CVE-2026-55617

Hydro (the hydrooj NPM package), a high-performance online judge platform, contains an insufficient session expiration vulnerability in its session recreation logic (packages/hydrooj/src/service/layers/base.ts). From 4.10.4 through 5.0.1 , a new session token is created without deleting the previ...

EUVD-2026-78590

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, exportspace and importspace in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and...

CVE-2026-53957 Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, exportspace and importspace in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and...

CVE-2026-53957

CVE-2026-53957 affects the Contentful MCP Server (@contentful/mcp-tools and @contentful/mcp-server). The export_space and import_space tools spread LLM-controlled host, proxy, rawProxy, and insecure arguments into the options passed to the Contentful Management API SDK, which then attaches the se...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

EUVD-2026-78586

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54168

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-48722

Nextflow (a DSL for data-driven computational pipelines) contains an incorrect default permissions flaw (CWE-276) in the nextflow auth login command. The Seqera Platform OIDC bearer token is written to ${NXF_HOME:-~/.nextflow}/seqera-auth.config via Java NIO without setting restrictive file permi...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh

A flaw was found in rabbitmq-server. When an existing Advanced Message Queuing Protocol AMQP connection refreshes its authentication token to one with revoked impersonation privileges, the server fails to update the active session's security tags. As a result, an authenticated user can retain...

rabbitmq-server: rabbitmq-server: Cross-site scripting via unescaped OAuth token injection

A flaw was found in rabbitmq-server. When Open Authorization OAuth is enabled for the management interface, the application fails to properly sanitize authentication tokens before embedding them into the bootstrap script. A remote attacker could exploit this cross-site scripting XSS vulnerability...

Security update for 389-ds

This update for 389-ds fixes the following issue: CVE-2026-11785: type confusion in the SSO token handler can cause partial stack address information disclosure bsc1268065. Changes for 389-ds: Update to version 2.0.20git94.63d290b04: Issue 7774 - Add backport action 7775 Issue 7733 - Typo about...

CVE-2026-91922

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-91922

Steedos Platform through version 3.0.15-beta.47 is affected by a reflected cross-site scripting (XSS) vulnerability in the anonymous /api/page/render endpoint. The root cause is the failure to properly escape query parameters within inline script elements. An attacker can craft malicious links co...

EUVD-2026-78413

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-91922 Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...

CVE-2026-91922

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaA...