https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T07:31:04.473739+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-120450 CVE-2026-120450 — LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool 2026-11-05T07:31:04.474618+00:00

Affected: LaraDashboard

LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send-email with any recipient, subject, and raw HTML body to deliver phishing or spam from the site's mailer.