CVE-2026-54618

Obsidian Web MCP , a remote MCP server for Obsidian vaults, contained an authentication bypass prior to version 0.2.0. The /oauth/authorize endpoint issued an authorization code without any login, consent, or session check, and /oauth/token allowed exchanging that code for the static VAULT_MCP_TO...

CVE-2026-54495

CVE-2026-54495 affects the OpenFeature Operator (version 0.9.2 and earlier). A tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with {NAMESPACE}/{NAME} syntax to reference a FeatureFlagSource or InProcessConfiguration in another namespace....

CVE-2026-54716

Valhalla (open source routing engine for OpenStreetMap data) versions 3.7.0 and earlier are vulnerable to a denial-of-service via the /sources_to_targets endpoint. A single unauthenticated POST request containing an exclude_polygons ring formed by three collinear points (zero-area geometry) trigg...

CVE-2026-45720

Omni (by Sidero Labs), a platform for managing Kubernetes on bare metal, VMs, or cloud, contains a TOCTOU race condition in SAML.getSession (internal/pkg/auth/interceptor/saml.go). The Used flag on a SAMLAssertion is checked and marked in two separate non-atomic operations, allowing concurrent re...

CVE-2026-45723

Omni (SideroLabs), a Kubernetes management platform, is vulnerable to same-host path traversal via the managementServer.CreateSchematic gRPC endpoint. The caller-controlled TalosVersion field is passed unsanitized to imageFactoryClient.OverlaysVersions, where url.URL.JoinPath resolves ../ sequenc...

CVE-2026-45726

Omni by Sidero Labs (a Kubernetes management platform) is vulnerable to excessive permission assignment in its ResourceService. In versions 1.3.0 through before 1.6.6 and 1.7.3 , importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the full CA secrets bundle....

CVE-2026-92757

MongoDB Entity Framework Core Provider is affected by a vulnerability where placing a database name in the connection string may inadvertently disable field-level encryption , leaving sensitive data unprotected. The root cause is a malformed connection string interpretation by the provider. The i...

CVE-2026-93337

NetworkManager-l2tp contains an improper input validation vulnerability in its handling of mru or mtu property values. A local user with VPN connection creation permissions can inject trailing non-numeric content after a valid integer, which is written verbatim into the pppd options file via writ...

CVE-2026-92758

This MongoDB -related vulnerability occurs when the application logging mode is set to DEBUG or a malformed MongoDB connection string is used, causing application logs to capture sensitive information such as passwords and AWS secure access keys. The root cause is overly verbose or misconfigured ...

CVE-2026-92993

Dromara mayfly-go (up to 1.11.5 ) is vulnerable to an OS command injection via the RunMachineScript function in server/internal/machine/api/machine_script.go (Machine Script Feature). Remote attackers with the machine:script:run permission and tag access can achieve arbitrary command execution on...

CVE-2026-92943

AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 (Python 3.7+) contain an improper certificate validation flaw in the MQTT client TLS connection layer. An adversary-in-the-middle can present a certificate issued for an unrelated hostname by a CA already in the device trust store, thereb...

CVE-2026-92756

This vulnerability affects the MongoDB Entity Framework Core Provider . Applications that combine independent encryption settings with the provider's own encryption settings may silently lose TLS and schema-map settings , causing protected fields to be stored unencrypted in the database. The flaw...

CVE-2026-90997

Keycloak deployments in stateless mode with MySQL or MariaDB are affected by a replay protection bypass caused by a mismatch in row-count semantics between the database driver and Keycloak's application logic. An attacker who intercepts single-use security artifacts—such as JWT client assertions ...

CVE-2026-19477

A stack-based buffer overflow was identified in MCC Universal Library for Linux (uldaq) , a library used for MCC data acquisition on Linux, affecting version 1.2.1 and prior . The flaw can lead to information disclosure or arbitrary code execution with a local attack vector, low complexity, and n...

CVE-2026-92230

Apache Karaf is vulnerable due to improper release of ClassLoader references in its XmlUtils component. XML parser and transformer factories are cached in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bund...

CVE-2026-54253

TS3 Manager , a web interface for maintaining TeamSpeak 3 servers, is vulnerable to a reflected XSS in the /api/download handler prior to version 2.2.6 . The attacker-controlled port query parameter is passed to socket.connect(port, host), and the resulting error.message is returned as text/html ...

CVE-2026-54504

CVE-2026-54504 affects MCP Documentation Server (@andrea9293/mcp-documentation-server) versions 1.13.0 through 1.13.1 . The root cause is that app.listen(PORT) in src/web-server.ts is called without a host argument, causing the Express server to bind to all interfaces (0.0.0.0:3080) rather than l...

CVE-2026-54617

GravitLauncher LaunchServer (open-source Minecraft launcher) is vulnerable to an unauthenticated path traversal in its HTTP file server (FileServerHandler.channelRead0) on port 9274 , which is enabled by default and bound to 0.0.0.0. The root cause is a substring(1) that strips the first characte...

CVE-2026-54524

Frappe HR (HRMS) is an open-source human resources management solution. In versions prior to 16.7.0 , an authenticated user with the HR User role can perform a SQL injection through filters in the Salary Payments Based on Payment Mode report. The root cause lies in salary_payments_based_on_paymen...

CVE-2026-52852

Traccar , an open-source GPS tracking system, is vulnerable to an uncontrolled infinite loop DoS prior to version 6.14.0 . An authenticated user with group-management and report permissions can create a cyclic group-parent hierarchy . The resource class GroupResource permits the cycle, while Attr...