Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion

## Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external

历史摘要 · 未重新核验 · GitHub Advisory

Perses's unvalidated project parameter enables filesystem path traversal

CVE-2026-63445

### Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the re

历史摘要 · 未重新核验 · GitHub Advisory

Perses's missing authorization in datasource proxy allows cross-scope secret disclosure

CVE-2026-63199

### Impact The datasource proxy authorizes the caller on the Datasource scope, then resolves and decrypts any Secret na

历史摘要 · 未重新核验 · GitHub Advisory

Perses's project query parameter authorization bypass exposes cross-project resources

CVE-2026-63458

### Impact _What kind of vulnerability is it?_ An authenticated user who is only a viewer on project team-a requests GE

历史摘要 · 未重新核验 · GitHub Advisory

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

CVE-2026-77339

## Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener wh

历史摘要 · 未重新核验 · GitHub Advisory

Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

CVE-2026-81505

## Summary frain-dev/convoy (all versions up to and including v26.6.2, no patch available) lets any authenticated caller

历史摘要 · 未重新核验 · GitHub Advisory

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

CVE-2026-63406

### Summary The telemetry subsystem embeds a hardcoded auth token (`"secret"`) in the public source and transmits raw CL

历史摘要 · 未重新核验 · GitHub Advisory

AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body

CVE-2026-63405

### Summary The Pusher-compatible REST API includes `body_md5` in the HMAC signature string but never computes or verifi

历史摘要 · 未重新核验 · GitHub Advisory

ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement

CVE-2026-58197

## Summary A containerized MCP server running with the default `network` permission profile (`insecure_allow_all: true`

历史摘要 · 未重新核验 · GitHub Advisory

kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace

CVE-2026-61682

# Summary The kcp front-proxy fails to strip client-supplied identity headers before forwarding requests to shards. Any

历史摘要 · 未重新核验 · GitHub Advisory

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

CVE-2026-61833

### Summary A bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot re

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

CVE-2026-61795

### Summary A parameter order bug in `internal/webhook/tenant/validation/hostname_regex.go` causes the `hostnameRegexHa

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

CVE-2026-61672

## Summary Capsule lets a cluster administrator forbid specific metadata keys that tenant owners must not place on thei

历史摘要 · 未重新核验 · GitHub Advisory

Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic

CVE-2026-61794

### Summary A validation bug in `internal/webhook/tenant/validation/forbidden_annotations_regex.go` allows an invalid `F

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

CVE-2026-86003

### Summary CoreDNS accepted [RFC 2136](https://datatracker.ietf.org/doc/html/rfc2136) UPDATE messages over DoH, DoH3,

历史摘要 · 未重新核验 · GitHub Advisory

CoreDNS: Unauthenticated memory exhaustion in custom transports

CVE-2026-82399

### Summary CoreDNS parses attacker-controlled DNS section counts before validating them on DNS-over-HTTPS (DoH and DoH

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

CVE-2026-81871

### Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creat

历史摘要 · 未重新核验 · GitHub Advisory

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

CVE-2026-81870

### Summary OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an inte

历史摘要 · 未重新核验 · GitHub Advisory

OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that...

CVE-2026-61709

### Description In OpenFGA, the ListUsers API could incorrectly return a user who should have been excluded. ### Prec

历史摘要 · 未重新核验 · GitHub Advisory

emp3r0r has an unauthenticated HTTP Polling DoS

CVE-2026-61554

### Summary The `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authent

历史摘要 · 未重新核验 · GitHub Advisory