Laravel TokenGuard configured for token-based API auth fails to reject crafted non-string credentials. With affected MySQL/MariaDB configurations, the auth lookup can match an unintended existing user, letting an unauthenticated attacker bypass TokenGuard-protected routes and take over an account. Affects versions prior to 12.68.0 and 13.29.0. Upgrade to 12.68.0 or 13.29.0 to mitigate.

mercury (pip) runs JupyterLab tokenless by default (–IdentityProvider.token=”, –ServerApp.disable_check_xsrf=True), enabling unauthenticated network clients to reach dangerous endpoints. CVE-2026-111057: missing comma in mercury_app/block_handler.py leaves /api/terminals unblocked, yielding an interactive OS shell via WebSocket. CVE-2026-111058: /api/kernels + /channels allows execute_request RCE. Affects 3.0.0-3.2.3 (fix 3.2.4) and `

CVE-2026-114625 is a low-complexity SQL injection in VeloCloud Orchestrator (VCO) On-Prem that lets any authenticated user (min role Enterprise Read Only) gain operator privileges and masquerade as local superuser operator, exposing internal-only functions and impacting the VCO host (CIA of orchestrator/managed data). Affected: `5.2.0-

LiteLLM reuses one cryptographic context for at-rest secrets and session tokens, letting an authenticated internal user craft metadata so the API-key flow returns an encrypted forged admin credential. Replaying the ciphertext as a bearer token makes the proxy trust proxy admin, enabling admin access and arbitrary commands via the MCP stdio endpoint. Affected: `>=1.87.0,=1.101.0,=1.102.0,=1.103.0,=1.104.0-rc.1,

Two CVSS 9.0 RCE flaws in Linux kernel ksmbd (SMB server) are public with no mainline fix. ZDI-CAN-33774: unauthenticated race in SMB1/SMB2 dispatch lets mixed packets trigger out-of-bounds reads and potential writes on port 445. ZDI-CAN-33549: SMB Direct integer underflow with crafted RDMA descriptors can overflow memcpy; requires RDMA, SMB Direct, and writable share. Disable ksmbd/SMB Direct or restrict 445 to mitigate.

Cisco Expressway Series Expressway-C/Expressway-E configured in a cluster is vulnerable to unauthenticated OS command execution as root via the database service. Persistent cookies plus missing client-cert validation when TLS Verify Mode=Enabled let an attacker with the cookies connect and invoke specific RPC commands. Affected: X14 and earlier. Upgrade to X15.5.3 or X15.5.20to mitigate