CVE-2026-90898

Bifrost unauthenticated remote code execution via MCP stdio client registration

Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.auth_config.is_enabled=false. Auth off means every caller is a local admin. One unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).  transports/v2.1.0 refuses an unauthenticated stdio registration with 403. transports/v2.0.0 still allows it.

CVSS 3.1 · 9.8 Critical EPSS 2.3% KEV · Not listed

Vendors

Maximhq

Products

Bifrost

CVE-2026-21109

Local Access Control Bypass in Samsung Watch Plugin

Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Samsung Mobile

Products

Watch Plugin

CVE-2026-78084

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified file types.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomshaper.com

Products

Sp Property Extension For Joomla

CVE-2026-85545

Privilege Escalation via Unauthorized API Access in HikCentral Access Control

There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hikvision

Products

Hikcentral Access Control

CVE-2026-88864

Capgo SSO Provider Authentication Bypass via PostgREST Direct Write

Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed through Supabase PostgREST. A holder of an ordinary Capgo full API key can insert a row with status='active' and enforce_sso=true, bypassing the intended backend SSO provisioning route (supabase/functions/_backend/private/sso/providers.ts) and its controls: the Enterprise plan requirement, SSO provider creation via the Supabase Management API, DNS TXT domain-ownership verification, the pending_verification → verified → active status transition, and issuance of a trusted provider ID by Supabase Auth. The forged row is trusted by SSO discovery and enforcement logic, including the unauthenticated login preflight endpoint /private/sso/check-domain, which then reports {"has_sso": true, "enforce_sso": true} for domains that were never verified, allowing attacker-controlled SSO enforcement to be asserted for arbitrary domains and disrupting normal login. All versions are affected; at the time of the advisory no patch was available.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Cap-go

Products

Cap-go

CVE-2026-47839

Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Cloudfoundry

Products

Cf-deployment Uaa

CVE-2026-87918

WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions

The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpbot

Products

Wordpress Wpot

CVE-2026-86672

ningzichun Student Management System Backup example.7z information disclosure

A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ningzichun

Products

Student Management System

CVE-2026-86519

code-projects Student Crud Operation Backup File card_activation.sql information disclosure

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Student Crud Operation

CVE-2026-86305

light0011 cms Upload.class.php upload unrestricted upload

A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Light0011

Products

Cms

CVE-2026-86217

code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosure

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Hotel And Tourism Reservation Hotel And Tourism Reservation In Php

CVE-2026-84651

Jenkins Agent Configuration Overwrite Vulnerability

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure permission on one agent to take over a different agent, gaining control of its configuration and obtaining access to its inbound agent secret and environment variables.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Jenkins Project

Products

Jenkins Jenkins

CVE-2026-70476

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organization.controller.ts accept attacker-controlled Stripe subscriptionId values without verifying that the identifier belongs to the authenticated user's organization. An authenticated attacker can perform unauthorized Stripe subscription operations on other tenants, including changing subscription plans or modifying seat quantities, resulting in financial impact and service disruption. This issue is fixed in 3.1.3.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Flowiseai

Products

Flowise

CVE-2026-70910

Unauthenticated REST API allows sensitive data exposure in Siebel CRM Integration

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Siebel Crm Siebel Crm Integration

CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-21100

Local Access Control Bypass Allows Launch of Arbitrary Activity in Samsung SystemUI

Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Samsung Mobile

Products

Android Samsung Mobile Devices

CVE-2026-73789

Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface

A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits, leading to unauthorized prolonged use of network resources.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe)

Products

Clearpass Policy Manager (cppm)

CVE-2026-13144

WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress Wp Travel

Products

Wordpress Wp Travel

CVE-2026-50165

alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuration" endpoints. The affected endpoints require organization or event ownership, but they accept an arbitrary configuration key and then return the first matching value from a lookup that includes system-level configuration. As a result, an organization owner can retrieve secrets intended to be administrator-only, including the system API key when it is configured. Version 2.0-M5-2605 fixes the issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Alfio-event

Products

Alf.io

CVE-2026-19625

IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Quarkus

Products

Enterprise Build Of Quarkus Oidc