![[vulnfeed] 10 critical CVEs — 2026-09-11 20:00 UTC](https://static-assets.buttondown.com/images/icons/icon-square%40400.png){kind=icon}
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS R
In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_settings`. As a result, the MCP Python SDK's DNS-rebinding protection (Origin/Host
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within t
An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earli
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below)
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
## SAML Tenant Binding Enables Cross-Tenant Account Takeover
Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should rece
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, t
Authorizer is an open-source, self-hostable authentication and authorization server. Prior to version 2.2.1, the `/authorize` endpoint accepts any `redirect_uri` without validating it against `Allowed
An example environment-configuration file for a bundled inventory-management component ships with a fixed, pub
An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into activ
yayson: Prototype pollution in Store/LegacyStore deserialization
`Store`/`LegacyStore` key internal lookup tables by the `type`, `id`, and relationship names from a JSON:API document. Because these were plain objects, a document with `type: "__proto__"` w
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
