A leaked SquareML access key potentially exposed personal and health information of 238,000 Denver Health Medical Plan members. The key was publicly accessible from June 27, 2025, until it was revoked on August 18, 2026. The compromised account was read-only, limiting the ability to alter or export data. The exposed data includes names, dates of birth, demographic details, health metrics, and hospital admission information, but excludes Social Security numbers and financial data. There is no evidence that the data was accessed or misused, only that it may have been.
OAuthLib versions from 3.3.0 up to but not including 4.0.0 contain a vulnerability in the device code grant workflow (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client configured for device workflow to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation. The issue is fixed in version 4.0.0.
MONAILabel server is vulnerable to a denial-of-service and silent inference corruption attack via crafted DICOM files exploiting pydicom's improper validation of Decimal String (DS) and Integer String (IS) values. An unauthenticated attacker can upload malicious DICOM files containing NaN or infinity values in spatial metadata fields, causing the server to crash or produce corrupted AI inference results. This affects MONAILabel versions prior to 1.6.1 and pydicom versions 0.9.7 through 3.0.2. The vulnerability arises because MONAILabel trusts pydicom output without validating these invalid values, and the REST API accepts uploads without authentication by default. A fix is available in MONAILabel 1.6.1.
dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS (Decimal String) and IS (Integer String) value representations. The vulnerability allows malformed input strings to bypass sanitization and produce JavaScript Infinity or NaN values, or accept scientific notation in integer fields, violating DICOM standards. This can corrupt spatial geometry, image display, radiation dose calculations, and other clinical data in downstream applications. The issue is fixed in dcmjs version 0.52.0.
Wails v2 contains a vulnerability in its origin validation logic where wildcard patterns in BindingsAllowedOrigins are improperly converted to regular expressions. This allows origins with suffixes matching the allowed pattern to bypass restrictions and invoke Go backend methods. The issue affects versions before 2.13.0 and can lead to unauthorized access to file systems, databases, or command execution depending on the exposed API surface. A fix is available in version 2.13.0.
Dolibarr ERP/CRM version 23.0.0 and earlier contains a SQL Injection vulnerability in the Third Party update functionality. The vulnerability arises from the localtax1_value (lt1) and localtax2_value (lt2) parameters being concatenated directly into an SQL UPDATE statement without proper sanitization or parameterization. An authenticated user with standard 'Third Party: Create/Edit' permissions can exploit this flaw to read and modify any database data, including sensitive information such as password hashes and API keys. The vulnerability allows injection of arbitrary SQL expressions, enabling data exfiltration and potential privilege escalation. The default unsalted MD5 password hashes facilitate cracking and admin account takeover. No official patch information is provided in the input data.
Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and certain LTS releases contain a Process Control vulnerability (CWE-114). This flaw allows a highly privileged remote attacker to potentially bypass protection mechanisms. The vulnerability has a high severity with a CVSS score of 7.2. Fixed versions are available starting from 8.9.0.0, 8.6.1.20, 8.3.1.40, and 7.13.1.80 depending on the release line.
Ajenti versions prior to 2.2.13 contain a critical remote code execution vulnerability (CVE-2026-27975) that allows unauthenticated users to execute arbitrary code on the affected server. This vulnerability has a CVSS score of 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed. The issue is fixed in version 2.2.13, and users are strongly advised to upgrade to this version promptly to mitigate the risk.
CVE-2026-10537 is an authentication bypass vulnerability in BMC Control-M/Enterprise Manager and Control-M/Server. It arises from a misconfiguration that may allow unauthenticated remote users to access certain service functionalities. This could lead to information exposure or impact service availability. The vulnerability affects versions 9.0.20 up to but not including 9.0.22, and potentially earlier unsupported versions. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and certain LTS releases contain a path traversal vulnerability (CWE-31). This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is addressed in fixed versions starting from 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0 onward.
CVE-2026-16307 is an authorization bypass vulnerability in Netiket Information Technologies EdoWEB that allows unauthorized access to functionality due to improper access control enforcement. The flaw exists in versions before 780-g7 and involves user-controlled keys bypassing ACL constraints. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-12887 is a path traversal vulnerability in Octopus Server that allows a user with permission to upload a malicious NuGet package to deploy a script step executing outside the intended directory. This could lead to unauthorized script execution beyond the parent directory boundaries. The vulnerability affects multiple versions of Octopus Server prior to fixed releases in 2026.1.674, 2026.2.973, and 2026.3.5839. The CVSS 4.0 score is 5.1, indicating a medium severity risk.
HPE has released patches addressing 72 vulnerabilities in its Aruba networking products' AOS-8 and AOS-10 wireless operating systems, including eight maximum-severity flaws that could allow unauthenticated remote code execution and authentication bypass. These vulnerabilities affect various hardware and virtual machines compatible with these operating systems. HPE recommends restricting management interfaces and applying patches promptly. No exploitation in the wild has been reported.
Electrum versions before 4.7.2 have a critical TOCTOU race condition vulnerability in the Nostr Wallet Connect plugin. This flaw allows malicious clients to bypass the daily spending limit by exploiting non-atomic budget checks and truncation of millisatoshi amounts. Attackers can send concurrent payment requests or repeatedly pay amounts that are rounded down, enabling them to drain funds beyond the intended limit.
Electrum versions from 0 up to 4.7.2 have an authorization bypass vulnerability in the external plugin loader. This flaw allows execution of a plugin's __init__.py module if the plugin is marked enabled in the config file, without verifying the plugin's password signature. A local attacker with write access to the Electrum data directory can exploit this to execute arbitrary code within the Electrum process. The issue is fixed in version 4.7.2.
Electrum versions before 4.8.3 have a vulnerability where the software fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions. This flaw allows malicious servers to replace a user's just-broadcast transaction with a conflicting transaction that appears to have zero fees and pays an attacker address. Users can be tricked into performing Replace-By-Fee (RBF) fee-bumping on this invalid transaction, effectively losing funds to the attacker. The issue is fixed in Electrum version 4.8.3.
CVE-2026-117573 is an OS command injection vulnerability in the hagent project (version 0). It allows MCP clients to execute arbitrary shell commands by injecting special characters into the args parameter of the hagent_arduino and hagent_esp32 tools. The vulnerability arises because these args are interpolated unsafely into subprocess.run calls with shell=True, enabling command execution as the MCP server user.
CVE-2026-117570 is a vulnerability in Vorota-ai nmap-mcp (version 0) where the scan_vulnerabilities tool improperly validates its allowlist of NSE script categories. This flaw allows callers, including MCP clients or prompt-injected agents, to bypass restrictions and run blocked script categories such as exploit, dos, brute, or intrusive against scan targets.
Kali-GPT version 0 contains an OS command injection vulnerability in the execute_tool() function within kali_gpt/tools/mcp_server.py. This flaw allows MCP clients to execute arbitrary OS commands by injecting shell metacharacters into parameters such as target, ports, domain, wordlist, or url. The vulnerability arises because these parameters are passed unsanitized to subprocess.run with shell=True, running with the MCP server user's privileges.
mcp-ffmpeg versions up to 1.0.5 contain an OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by providing specially crafted input values for videoPath or outputDir parameters in certain tools. The vulnerability arises from improper neutralization of special shell characters, enabling command string breakouts and execution with the MCP server user's privileges.