1790 matches found
PT-2026-67580
Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated remote attacker crash the entire frps process with a single five-byte message. When the gateway parses an SSH exec channel request in pkg/ssh/server.go, it adds a small constant to a...
openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21388-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21388-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-10263:...
PT-2026-67602
Summary pheditor's terminal feature restricts callers to an allowlist of commands TERMINAL COMMANDS and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their o...
labymod-poc
Security Audit Report — Laby Launcher 3.0.11 Target: Laby Launch...
knot-doq
Knot Resolver 6.3.0 — DNS-over-QUIC heap overflow → RCE PoC...
Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c4wf-2xxc-68qm. This link is maintained to preserve external references. Original Description Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField...
GHSA-PP9R-PPC4-25W4 Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c4wf-2xxc-68qm. This link is maintained to preserve external references. Original Description Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField...
CVE-2026-65608
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
CVE-2026-65608 Grav before 2.0.9 Remote Code Execution via FlexDirectory
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
CVE-2026-65608
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
CVE-2026-65608
Grav prior to 2.0.9 is vulnerable to remote code execution via FlexDirectory. The flaw in FlexDirectory::dynamicDataField() uses attacker-influenced input with call_user_func_array() and only validates that the target is callable, allowing arbitrary shell commands when an authenticated user with ...
CVE-2026-65608
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
PYSEC-2026-3536 PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse" binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controls origin...
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
The MCP SSE server started via ToolsMCPServer.runsse / launchtoolsmcpservertransport="sse"binds to 0.0.0.0 by default and builds its Starlette application with no authentication middlewareand no Origin-header validation. The module mcp/mcpsecurity.py provides exactly the needed controlsorigin...
Security update for the Linux Kernel (important)
openSUSE security update: security update for the linux kernel ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21388-1 Rating: important References: bsc1149651 bsc1204315 bsc1236743 bsc1255029 bsc1257506 bsc1258538 bsc1259800 bsc1260565 bsc1261250...
CVE-2026-65608: Use of Externally-Controlled Input to Select Classes or Code
Grav versions = 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField resolves blueprint data-@: directives by calling calluserfuncarray on attacker-influenced input, validating only that the target is callable iscallable without restricting dangero...
PT-2026-64136
The MCP SSE server started via ToolsMCPServer.run sse / launch tools mcp servertransport="sse" binds to 0.0.0.0 by default and builds its Starlette application with no authentication middleware and no Origin-header validation. The module mcp/mcp security.py provides exactly the needed controls...