CVE-2026-31944 LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...

CVE-2026-31944 LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...

CVE-2026-31944 LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the UnwrapKey logic of the SM9 decryption implementation. An attacker can cause unauthorized message decryption and integrity bypass by crafting a ciphertext with the elliptic-curve...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the UnwrapKey logic of the SM9 decryption implementation. An attacker can cause unauthorized message decryption and integrity bypass by crafting a ciphertext with the elliptic-curve...

deep-code-security

deep-code-security Multi-language Static Application Security...

BIT-PARSE-2026-31901 Parse Server has user enumeration via email verification endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0, the email verification endpoint /verificationEmailRequest returns distinct error responses depending on whether an email address belongs to an existing user, is alrea...

Attackers impersonate Temu in ClickFix $Temu airdrop scam

Update Friday, March 13: A Temu spokesperson contacted us to say: " Temu has not issued any cryptocurrency, token, or digital asset—including any so-called "Temu Coin." Any airdrop, wallet claim, or cryptocurrency offer purporting to be from Temu is fraudulent and has no connection to our company...

Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.52: CVE-2025-66614: client certificate verification bypass due to virtual host mapping bsc1258371. CVE-2026-24733: improper input validation on HTTP/0.9 requests bsc1258385. CVE-2026-24734: certificate revocation bypass du...

SUSE-SU-2026:0890-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.52: - CVE-2025-66614: client certificate verification bypass due to virtual host mapping bsc1258371. - CVE-2026-24733: improper input validation on HTTP/0.9 requests bsc1258385. - CVE-2026-24734: certificate revocation...

CVE-2026-22182 wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType

wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint with arbitrary postId and commentid...

PT-2026-25381

Pigeon is a message board/notepad/social system/blog. Prior to 1.0.201, the application uses $ SERVER'HTTP HOST' without validation to construct email verification URLs in the register and resendmail flows. An attacker can manipulate the Host header in the HTTP request, causing the verification...

CVE-2026-32597: Insufficient Verification of Data Authenticity

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting...

AlmaLinux 9 : gnutls (ALSA-2026:4188)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:4188 advisory. gnutls: Stack-based Buffer Overflow in gnutlspkcs11tokeninit Function CVE-2025-9820 gnutls: GnuTLS: Denial of Service via excessive resource consumption...

WordPress plugin wpDiscuz 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There wa...

The vulnerability of the Fortinet FortiClient Enterprise Management Server (EMS) and the FortiClient EMS Cloud cloud storage service lies in insufficient verification of the connection source. This allows attackers to replace the trusted host.

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS and the FortiClient EMS Cloud cloud storage service is related to insufficient verification of the connection source. Exploiting this vulnerability allows a malicious actor to replace the trusted host...

cpp-httplib 信任管理问题漏洞

cpp-httplib is a C++ library developed by Yhirose, designed for HTTP/HTTPS servers and clients. Prior to version 0.37.2 of cpp-httplib, there was a vulnerability related to trust management. This vulnerability occurred when a client configured a proxy and enabled setfollowlocation, causing TLS...

PT-2026-29228

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.12 Description OpenClaw automatically discovers and loads plugins from the .OpenClaw/extensions/ directory without explicit trust verification. This allows for arbitrary code execution, as attackers can includ...

GStreamer 安全漏洞

GStreamer is an open-source framework for processing streaming media. GStreamer has a security vulnerability that stems from the lack of verification of the data length provided to users when processing stream headers in ASF files. This vulnerability may lead to heap buffer overflows and remote...

CVE-2026-32597

A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This...