CVE ID :CVE-2026-6212 Published : July 10, 2026, 6:35 p.m. | 42 minutes ago Description :Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege Abuse. This issue affects TeraMIS: from V03.26.01.14 through 30.04.2026. Severity: 8.8 |…
CVE ID :CVE-2026-61459 Published : July 10, 2026, 6:34 p.m. | 43 minutes ago Description :MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by…
CVE ID :CVE-2026-61460 Published : July 10, 2026, 6:24 p.m. | 53 minutes ago Description :Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or…
CVE ID :CVE-2026-56668 Published : July 10, 2026, 6:16 p.m. | 1 hour, 1 minute ago Description :ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL’s OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-exchange does not verify that the subject token…
CVE ID :CVE-2026-2397 Published : July 10, 2026, 6:16 p.m. | 1 hour, 1 minute ago Description :Improper neutralization of special elements used in an SQL command (‘SQL injection’) vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue…
Datadog Security Labs is warning of “several overlapping campaigns” that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. “Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub ‘ghost’ accounts that…
CVE ID :CVE-2026-61343 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :LibreBooking’s email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write…
CVE ID :CVE-2026-59726 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo’s default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group…
CVE ID :CVE-2026-59734 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify’s app generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and…
CVE ID :CVE-2026-59826 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties…