deleting-the-trace

Control-token injection attacks on tool-using agents Code and logged measurements for a study of two input-level attacks on tool-using language model agents. The first attack appends a short string of a model's own channel-control tokens to untrusted input; the tokenizer reads it as an...

CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

UBUNTU-CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

CVE-2026-34990

CVE-2026-34990 — escalation locale di privilegi in CUPS cups2root, de-harnessed CVSS 3.x : 8.4 HIGH approssimativo — verificare CWE : CWE-287 Autenticazione Impropria + CWE-269 Gestione Impropria dei Privilegi Fix : CUPS 2.4.17+ Interessa: CUPS ≤ 2.4.16 con cupsd in esecuzione come root e 631...

cups-2.4.16-lpe

CUPS 2.4.16 — Local Privilege Escalation CVE-2026-34990 📋 Summary CUPS 2.4.16 contains a local privilege escalation vulnerability also tracked as GHSA-c54j-2vqw-wpwp. The Vulnerability 1. World-writable socket — /run/cups/cups.sock is world-writable, allowing any local user to send IPP requests t...

CVE-2026-76286

In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...

EUVD-2026-94587

In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...

CVE-2026-76286

The Splunk MCP Server is vulnerable to a Server-Side Request Forgery (SSRF) in versions below 1.2.1 . A user with the mcp_tool_execute capability can be induced to run a custom API tool configured by another user. This flaw allows the server to send the executing user's Splunk platform authentica...

CVE-2026-76286 Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server

In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface API tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it t...

CVE-2026-76274 Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

EUVD-2026-94626

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

CVE-2026-76274

Splunk Enterprise versions below 10.4.3 , 10.2.7 , and 10.0.10 are vulnerable to a Server-Side Request Forgery (SSRF) within the Splunk App for Splunk Observability Cloud . An attacker with a role possessing the read_o11y_content capability can exploit the REST API to redirect outbound requests t...

EUVD-2026-93509

Payload authentication token field handling issue...

GHSA-66WR-7VMR-P5JQ Payload authentication token field handling issue

Impact Under certain field configurations, Payload could include unintended values in the authentication token issued at login. You are affected if: - You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name. Patches...

Payload authentication token field handling issue

Impact Under certain field configurations, Payload could include unintended values in the authentication token issued at login. You are affected if: - You use an affected Payload version and have configured a custom field option that maps a field to a reserved authentication claim name. Patches...

NPM: Payload authentication token field handling issue

NPM: Payload authentication token field handling issue vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

CVE-2026-59358

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-59358 CVE-2026-59358 Class: Privilege leftover Reach: Remote Cloud Foundry UAA v79.6.0 - VMware by Broadcom / Cloud Foundry Foundation I am @abraxasnull. Loopback lab. The client is...

NPM: Ghost: Invite Token Disclosure in Ghost Admin API

NPM: Ghost: Invite Token Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions = 4.39.0, 6.64.0...

Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...

GHSA-V6Q3-XQXM-6F5V Ghost: Invite Token Disclosure in Ghost Admin API

Impact Staff users with permission to view staff invites were able to discover the secret token of pending invites, including invites for roles with higher privileges than their own. This could allow a staff user to escalate their privileges by accepting a pending invite. Vulnerable versions This...