CVE-2026-50105

MediumCVSS 4.3/10Last modified Aug 26, 2026

Description

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Aug 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-501066.5When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' forCVE-2026-501078.1When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINCVE-2026-501087.5The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requesterCVE-2026-50116.3A vulnerability was detected in elecV2 elecV2P up to 3.8.3. This vulnerability affects the function runJSFile of the file /webhook of the coCVE-2026-501109.2Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While tCVE-2026-501128.8SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file cCVE-2026-50127.3A flaw has been found in elecV2 elecV2P up to 3.8.3. This issue affects the function pm2run of the file /rpc. Executing a manipulation can lCVE-2026-501247.1DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase can be exploited by uploading payload.zip througCVE-2026-501257.5MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/servCVE-2026-501264.0Adaguc-server is an open source geographical information system to visualize, combine, compare and share real-time meteorological, climatoloCVE-2026-501275.9Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly accounCVE-2026-501285.3Mastodon is a free, open-source social network server based on ActivityPub. From 4.3.0 until 4.5.11 and 4.4.18, Mastodon has a feature to le
CVE-2026-50105: Medium severity, CVSS 4.3 | Vulnix