CVE-2026-75060
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
CVSS
8.4
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 17 ago 2026 · Última mod.: 18 ago 2026 · CWE-306
Sin historial EPSS suficiente todavía.
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-566778.6 ALT—
——09Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.1dCVE-2026-754797.5 ALT—
——0JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.1dCVE-2026-715669.3 CRÍ—
——0FakeFish handles incoming credentials by passing them down
to scripts. This works for real hardware because in the end it's up to
the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file
mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the
user that created fakefish, power them on and off, and mount arbitrary CD
images to them.2dCVE-2026-199714.7 MED29.3%
——9A flaw has been found in LB-Link WR1210M 1.0.3. This impacts the function main of the file /www/cgi-bin/backup.cgi of the component Backup Endpoint. This manipulation causes missing authentication. The attack is only possible within the local network. The vendor was contacted early about this disclosure but did not respond in any way.2dCVE-2026-742455.9 MED23.1%
——7A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook callbacks. This vulnerability leads to information disclosure, potentially exposing sensitive data such as usernames, email addresses, IP addresses, and action-specific metadata.13hCVE-2026-742436.5 MED17.4%
——5A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Clair API URL paths. The primary consequence is worker resource exhaustion and blind path manipulation on the configured Clair host, potentially leading to a denial of service.13h