The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse...
CVE-2026-16498
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-H
#severity:critical
共收录 1468 条相关情报。
← 返回所有主题A stored cross-site scripting vulnerability existed in the capture tree visualization page. The...
CVE-2026-66824
A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel...
CVE-2026-66012
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated onl
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console...
CVE-2026-66013
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows una
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side...
CVE-2026-61884
The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credential
Shescape: Shell injection via unescaped parentheses on Windows with CMD
### Impact This impacts users of Shescape on Windows that explicitly configure `shell` to CMD, or `true` with the defau
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
## Summary The forced password-change flow, triggered when the stored password is still the default (`admin`), does not
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
## Summary `sm-crypto` (npm package **0.4.0**, the latest release, published 2026-01-20) generates SM2 private keys and
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
### Summary When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a **different** user, P
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplie
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information...
CVE-2026-62835
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
## Summary Budibase attaches a REST datasource's stored credentials (Bearer/Basic tokens and static headers) to an outgo
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
### Summary Budibase's OIDC SSO login links an incoming SSO identity to an existing Budibase account **by email address
Budibase: SQL Injection via `multipleStatements: true`
## Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote atta
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
CVE-2026-62379
## Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
CVE-2026-62263
### Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an `ObjectInputFilter` meant t
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform...
CVE-2026-56191
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code...
CVE-2026-56165
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over...
CVE-2026-54120
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a...
CVE-2026-58275
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.