2099412 matches found
MINI-XVXQ-MW2G-QF2J
Bulletin has no description...
MINI-X4J4-Q724-XR23
Bulletin has no description...
MINI-JQGG-5XJF-33CH
Bulletin has no description...
MINI-C8PM-JQV7-P385
Bulletin has no description...
GHSA-JGH3-FGGC-MCPM Obot: Server-Side Request Forgery via remote MCP server URL
Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched server-side with no validation of the destination. There is no guard against loopback, link-local, RFC1918 private ranges, or the cloud metadata endpoint 169.254.169.254, so a use wi...
GHSA-PR6H-VR44-XQ8J Obot: MCP Registry API readable without authentication
Summary In affected versions, enabling registry authentication OBOTSERVERENABLEREGISTRYAUTH=true does not actually protect the MCP Registry endpoints under /v0.1/ — they remain readable by unauthenticated callers. Am I affected? You are affected if you run Obot = v0.22.1 with...
GHSA-XWMW-PRC4-V3CR Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion
Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivered...
GHSA-5GMM-HJFJ-8FF7 Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)
Summary The service downgrade implementation in app/Livewire/Services/Upgrade.php::doUpgrade executes a proration calculation and a subsequent user credit refund without any transactional safety or database locks. The only concurrency check relies on an unisolated database query checking for...
GHSA-9JJC-FW8X-FMWX io.moquette:moquette-broker has a Missing Authorization issue
Summary Moquette MQTT Broker fails to enforce ACL write permission checks when publishing Will Last Will and Testament messages on behalf of disconnected clients. All normal PUBLISH paths receivedPublishQos0, receivedPublishQos1, receivedPublishQos2 correctly invoke authorizator.canWrite before...
CVE-2026-59163 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/syncserver.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with options that effectively disabled signature verification. Th...
MINI-6QM3-26PG-XQQ6
Bulletin has no description...
MINI-QJVV-F65W-5P88
Bulletin has no description...
MINI-4PVX-PJJJ-GQ52
Bulletin has no description...
MINI-2928-RCXR-H4CH
Bulletin has no description...
MINI-JWGF-CCGM-8CWH
Bulletin has no description...
MINI-628J-23HX-RG8X
Bulletin has no description...
MINI-259X-MM89-XHPJ
Bulletin has no description...
MINI-H8WP-R735-QH2J
Bulletin has no description...
MINI-53HF-6CRC-GHM3
Bulletin has no description...
MINI-7C7F-3Q2R-HVVJ
Bulletin has no description...
MINI-P4V9-G7GR-5R6R
Bulletin has no description...
MINI-5PGH-JFMW-HWV9
Bulletin has no description...
MINI-85G9-9792-9MW8
Bulletin has no description...
MINI-X4XQ-7JHX-PH35
Bulletin has no description...
MINI-3XXH-8CCQ-3X3P
Bulletin has no description...
MINI-RQQ7-P8JH-WH48
Bulletin has no description...
MINI-66P5-3679-487F
Bulletin has no description...
MINI-M89F-WW7V-8VFC
Bulletin has no description...
MINI-89W8-MR88-J33G
Bulletin has no description...
MINI-JCX8-PMHX-45W8
Bulletin has no description...
GHSA-XCW4-53CC-HV32 Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
Summary The Mnemosyne sync server's authentication check decoded JWT bearer tokens but never verified their HMAC-SHA256 signatures. Any well-formed token was accepted, allowing an unauthenticated attacker to impersonate any user and read or modify their sync data. Severity: Critical CVSS 3.1:...
MINI-6CFQ-H9HV-R42P
Bulletin has no description...
MINI-74F3-3HRW-7W8F
Bulletin has no description...
MINI-HQR5-X8GC-RVF7
Bulletin has no description...
MINI-MVM6-F36H-M32X
Bulletin has no description...
MINI-39C7-V4GG-C4QC
Bulletin has no description...
MINI-RC9M-WGG5-33MP
Bulletin has no description...
MINI-RV4V-G344-MGGQ
Bulletin has no description...
MINI-58MQ-Q6VJ-CX26
Bulletin has no description...
MINI-MMQM-6Q5J-FQPJ
Bulletin has no description...
MINI-5X2X-WJCX-RMJ9
Bulletin has no description...
MINI-QM4H-X87Q-WMCR
Bulletin has no description...
MINI-5H6W-Q4CQ-VFGJ
Bulletin has no description...
CVE-2026-93753 deepmerge through 4.3.1 Prototype Poisoning via mergeObject
deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject function that fails to properly validate keys being written to target objects. Attackers can supply malicious source objects in merge operations to inject attacker-controlled properties into the returned...
CVE-2026-93749 source-map-js through 1.2.1 Event Loop Denial of Service
source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the...
MINI-G228-W3H2-2463
Bulletin has no description...
MINI-73W8-J9WR-5F93
Bulletin has no description...
MINI-X7WR-3RMQ-94P6
Bulletin has no description...