Reserved but Public CVEs

CVE-2026-52882 is an authorization flaw in MantisBT affecting REST and SOAP API issue update handling. The vulnerability allows users whose privileges are below the configured report_issues_for_unreleased_versions_threshold to assign unreleased product versions when updating issues through the API. The issue stems from improper authorization or validation in the API path, enabling behavior that should be restricted by the product's version-release permission model.

CVE-2026-52882First seen Jul 16, 2026

CVE-2026-54495 is an information disclosure vulnerability in open-feature-operator caused by implicit cross-namespace resolution of FeatureFlagSource and InProcessConfiguration resources. In multi-tenant Kubernetes environments where namespaces are used as trust boundaries, a tenant with permission to create a controller-owned workload in its own namespace can reference another namespace's FeatureFlagSource or InProcessConfiguration. The operator may then materialize the referenced resource's spec contents into the attacker's workload, exposing inline configuration data that should remain isolated to the source namespace. Exposed data can include inline environment variable values, bearer tokens used for HTTP synchronization, and synchronization URIs. The issue stems from improper isolation of resources across namespaces rather than a failure of Kubernetes secret namespace enforcement itself.

CVE-2026-54495First seen Jul 16, 2026

CVE-2026-54504 affects @andrea9293/mcp-documentation-server version 1.13.0. The product's Web UI and API are exposed on all network interfaces by default, and document-management endpoints do not require authentication. This creates an improper access control condition in which any attacker with network reachability to the service can interact directly with the document-management functionality without credentials. Successful exploitation allows unauthorized access to document enumeration, document retrieval, corpus search, document insertion, deletion, and modification of the local knowledge base used by the MCP assistant.

CVE-2026-54504First seen Jul 16, 2026

CVE-2026-54254 is an information exposure vulnerability in cyberdrop-dl-patched affecting handling of Pixeldrain URLs. When processing Pixeldrain links, the application could send an Authorization header containing the user's configured Pixeldrain API key to attacker-controlled lookalike domains because the URL validation logic relied on insufficient host matching rather than exact verification of an official Pixeldrain domain. As a result, a crafted URL that satisfied the crawler's substring-based domain logic could cause disclosure of the API credential to an external server under attacker control.

CVE-2026-54254First seen Jul 16, 2026

CVE-2026-54451 is a denial-of-service vulnerability in the Hex package protobuf affecting Protobuf.Decoder during decoding of embedded messages. The flaw stems from unbounded recursion depth when processing deeply nested self-referential or cyclic protobuf message structures. A crafted protobuf payload can drive the decoder into extremely deep recursive descent without an effective depth limit, resulting in excessive resource consumption. Fixed versions introduce recursion-depth limiting during embedded-message decoding and raise Protobuf.DecodeError when the configured limit is exceeded.

CVE-2026-54451First seen Jul 16, 2026

CVE-2026-49280 is an authorization flaw in MantisBT affecting issue status changes performed through the REST and SOAP APIs. A user who has permission to update an issue can modify that issue's status through these API interfaces even when the configured status-change threshold is intended to restrict such transitions to users with higher privileges. The vulnerability results from improper enforcement of authorization checks on API-driven workflow changes, allowing the API path to bypass the configured privilege threshold for status transitions.

CVE-2026-49280First seen Jul 16, 2026

CVE-2026-50270 is a denial-of-service vulnerability in Datadog's dd-trace-java library affecting parsing of W3C baggage propagation headers during trace context extraction. Improper handling of oversized or highly fragmented baggage header values can cause unbounded CPU and memory consumption while the tracer processes inbound HTTP requests. The issue is reachable remotely through crafted HTTP requests sent to services instrumented with the Java tracer and exposed over the network.

CVE-2026-50270First seen Jun 12, 2026

CVE-2026-55512 is an unauthenticated resource-exhaustion vulnerability in nebula-mesh when OIDC is enabled. The Web UI OIDC login endpoint allocates server-side in-memory state entries for login attempts and does not adequately bound or rate limit creation of those entries. Repeated requests to the OIDC login route can therefore cause the application to accumulate large numbers of live OIDC state objects that remain resident for approximately 10 minutes. This permits remote memory growth and can degrade service availability.

CVE-2026-55512First seen Jul 15, 2026

CVE-2026-54629 is an arbitrary file read vulnerability in Anyquery when operated in server mode. The MySQL-compatible server interface exposes SQLite virtual table modules, including file-backed readers such as csv_reader and log_reader, without sufficient path restriction or sandboxing. An unauthenticated remote attacker can issue queries that cause the server to open and read local files accessible to the Anyquery process. The flaw stems from unrestricted access to local filesystem resources through exposed virtual table functionality, enabling retrieval of sensitive server-side file contents.

CVE-2026-54629First seen Jul 15, 2026

CVE-2026-50158 is an arbitrary file write vulnerability in the yutu MCP `caption-download` tool. The flaw arises because the user-controlled `file` parameter is passed directly to file creation logic via `os.Create()` without confinement to the intended `YUTU_ROOT` directory boundary. As a result, an attacker who can invoke the tool can cause yutu to create or truncate files at attacker-selected filesystem paths writable by the yutu process. The issue is caused by improper restriction of externally controlled file paths, allowing writes outside the expected root-scoped workspace.

CVE-2026-50158First seen Jul 15, 2026

CVE-2026-44300 is an unauthenticated file write vulnerability in OpenCost affecting the /serviceKey endpoint. The flaw allows a remote attacker to overwrite or inject the Google Cloud service account key file used by the application. The issue stems from missing authentication on a sensitive administrative function that accepts service key material and writes it to disk. By abusing this endpoint, an attacker can replace trusted cloud credentials with attacker-controlled content or corrupt the existing key material, altering how OpenCost authenticates to cloud services and potentially exposing access to cloud cost and billing-related data.

CVE-2026-44300First seen Jul 15, 2026

CVE-2026-61549 is a privilege escalation vulnerability in Woodpecker deployments that use the Kubernetes backend. The flaw arises from unrestricted use of the Kubernetes backend configuration option for service account selection in pipeline pod specifications, allowing a user-controlled pipeline execution context to specify an arbitrary Kubernetes ServiceAccount within the pipeline namespace. Because the resulting pod inherits the RBAC permissions associated with the selected ServiceAccount, an attacker with sufficient repository-level access can cause CI pipeline workloads to execute with elevated Kubernetes privileges beyond those intended for that user or repository. The issue affects the trust boundary between repository contributors and the Kubernetes execution environment and can expose cluster resources and secrets accessible to higher-privileged ServiceAccounts.

CVE-2026-61549First seen Jul 15, 2026

CVE-2026-50125 is a denial-of-service vulnerability in github.com/StacklokLabs/mkp affecting the pod log retrieval functionality. The vulnerable behavior allows a remote unauthenticated attacker to provide excessively large limitBytes and tailLines values when requesting Kubernetes pod logs. The server then reads and copies an excessive volume of log data into memory using an unbounded in-memory copy pattern rather than enforcing strict upper limits or bounded reads. This can exhaust available memory and terminate the MKP server process, resulting in loss of service availability.

CVE-2026-50125First seen Jul 15, 2026

CVE-2026-45693 is an unauthenticated path traversal vulnerability in FacturaScripts static file controllers. The flaw allows attacker-supplied path traversal sequences to influence file resolution for requests to static asset routes, causing the application to serve files outside the intended public asset locations. The vulnerable logic appears to rely on raw URL prefix or route-based checks rather than canonicalized filesystem path validation. As a result, a crafted request can traverse into other allow-listed locations within the FacturaScripts installation directory and expose non-public files. The issue is mitigated only partially by file-type restrictions, as executable PHP files are reportedly not included in the allow-list, but sensitive business documents and stored data remain exposed.

CVE-2026-45693First seen Jul 15, 2026

CVE-2026-50157 is an improper handling issue in the Auth0 Symfony SDK affecting deployments that use the Authorizer security authenticator to protect HTTP routes. In vulnerable versions, the authenticator may accept OAuth 2.0 bearer access tokens supplied in a URL query parameter rather than restricting token processing to the HTTP Authorization header. This behavior weakens the confidentiality expectations for bearer tokens because URLs are commonly recorded or propagated by application logs, browser history, referrer headers, reverse proxies, and other intermediaries. As a result, valid access tokens may be exposed and subsequently replayed against protected API endpoints.

CVE-2026-50157First seen Jul 15, 2026

CVE-2026-53604 is a sensitive-data exposure vulnerability in nebula-mesh affecting web mobile-bundle code paths. The flaw arises because the certificate authority private key loaded into memory is not reliably wiped after use, including on error-return paths. In the vulnerable implementation, the loaded CA manager remains in process memory instead of being zeroized, allowing the plaintext CA signing key to persist longer than intended. The issue is corrected by ensuring the loaded CA manager is wiped on all return paths and by keeping the wipe routine idempotent.

CVE-2026-53604First seen Jul 15, 2026

CVE-2026-55513 is an authorization and policy-enforcement flaw in nebula-mesh affecting the Web UI host-creation workflow. When a host is created through the Web UI, the application does not honor configured enrollment token lifetime settings and instead issues a bearer enrollment token with an effective lifetime of approximately 24 hours. This behavior diverges from the API path, which correctly applies the configured TTL resolution logic, including server-wide and per-network enrollment_token_ttl values. As a result, the Web UI path bypasses intended administrative restrictions on token validity and weakens controls designed to limit the exposure window of enrollment credentials.

CVE-2026-55513First seen Jul 15, 2026

CVE-2026-45263 is a CSV formula injection vulnerability in the FacturaScripts CSVExport functionality. The flaw allows an authenticated low-privileged user to place spreadsheet formula payloads into application data that is later exported to CSV. When the exported file is opened in a spreadsheet application, cells beginning with formula-interpreted characters can be evaluated as active formulas rather than inert text. This indicates insufficient neutralization of formula-leading characters during CSV generation, enabling attacker-controlled content in exported fields, and potentially in headers or other spreadsheet-loadable export outputs, to trigger client-side execution or data access in the context of the user opening the file.

CVE-2026-45263First seen Jul 15, 2026

CVE-2026-54446 is an authentication enforcement flaw in netlicensing-mcp when deployed in HTTP transport mode. The vulnerability stems from missing authentication checks in ApiKeyMiddleware, allowing unauthenticated HTTP requests to invoke MCP tools while the service uses the server operator's configured NETLICENSING_API_KEY for downstream NetLicensing REST API operations. As a result, requests that should require client authentication are processed under the server's own authority. This creates an authentication bypass condition that exposes licensing-management functionality to unauthenticated remote users.

CVE-2026-54446First seen Jul 15, 2026

CVE-2026-50013 is a denial-of-service vulnerability in Hoverfly affecting Diff mode. The flaw is caused by unsynchronized concurrent access to a shared responsesDiff map, creating a race condition in which concurrent requests can trigger simultaneous map reads and writes. In Go, this condition can cause a fatal runtime error and terminate the process. An attacker able to send traffic to the proxy port can exploit the issue by generating concurrent requests that exercise Diff mode and reach the vulnerable shared state.

CVE-2026-50013First seen Jul 15, 2026

CVE-2026-53603 is an exposure of sensitive authentication material in nebula-mesh caused by storing operator session tokens in plaintext in the application database. Because the tokens are persisted without cryptographic protection, any party that obtains read access to the database contents, including backups or snapshots, can recover valid active session tokens directly. Version 0.3.8 changes token handling to store only a SHA-256 hash of session tokens and invalidates active sessions on deployment.

CVE-2026-53603First seen Jul 15, 2026

CVE-2026-61699 is a certificate validation flaw in nebula-mesh in which certificate revocation is not enforced across the mesh. Agent-side handling of the per-CA blocklist is not implemented, and generated agent configuration omits the pki.blocklist setting. As a result, certificates associated with blocked, offboarded, or compromised hosts remain trusted by peer nodes until the certificates naturally expire rather than being rejected after revocation. The issue affects the mesh trust model by preventing timely invalidation of previously issued credentials.

CVE-2026-61699First seen Jul 15, 2026

CVE-2026-54087 is a stored cross-site scripting vulnerability in EasyCorp EasyAdmin Bundle affecting FileField and ImageField handling of uploaded content. The issue arises when an attacker can upload browser-executable content such as HTML or SVG files that are then stored under the public web root and served inline by the application. When another user later opens the uploaded file from the administrative backend, the browser executes attacker-controlled JavaScript in the security context of the authenticated EasyAdmin session. The vulnerability is persistent because the malicious payload is stored on the server and triggered when viewed by a victim through the application workflow.

CVE-2026-54087First seen Jul 15, 2026

CVE-2026-54628 is a server-side request forgery vulnerability in Anyquery server mode. The issue arises because built-in SQLite virtual table modules can initiate outbound HTTP requests without adequate restriction, allowing access to localhost, internal network destinations, and cloud metadata services. In deployments where the MySQL-compatible server port is reachable by untrusted clients, an attacker can abuse query functionality to cause the server to perform arbitrary HTTP requests to attacker-chosen targets that are otherwise inaccessible from the attacker’s network position.

CVE-2026-54628First seen Jul 15, 2026

CVE-2026-50018 is a denial-of-service vulnerability in Hoverfly affecting remote post-serve actions. The flaw is caused by unbounded goroutine leaks when these actions use Go's default HTTP client without configured timeouts. If a remote post-serve action is configured to contact a non-responsive endpoint, requests can remain blocked indefinitely and accumulate over time, causing uncontrolled growth in concurrent goroutines and associated resource consumption within the Hoverfly process.

CVE-2026-50018First seen Jul 15, 2026