CVE-2026-19046 NocteDefensor LudusMCP ludus_environment_guides_search ludusEnvironmentGuidesSearch.ts path traversal

A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...

CVE-2026-19046

CVE-2026-19046 affects NocteDefensor LudusMCP (up to 1.0.24). The vulnerable element is an unknown function in src/tools/ludusEnvironmentGuidesSearch.ts of the ludus_environment_guides_search component. According to the description, manipulating the guide_name argument enables path traversal, wit...

EUVD-2026-54079

A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...

EUVD-2026-53951

Shop manager Cross Site Scripting XSS in FiboSearch = 1.33.0 versions...

EUVD-2026-53942

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-28139 WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-28139 WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-28139

CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...

CVE-2025-11850 Improper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]

When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup clai...

A Bootiful Podcast: Data guru Gregory Green on RabbitMQ, Valkey, Gemfire, Data Flow, and more

Hi, Spring and data fans! Want a faster, smarter data stack? Tune into this episode with Gregory Green for a deep dive into GemFire, RabbitMQ Streams, Dataflow, and more. We cover real-time event processing, active-active consistency, full-text search, vector search, and how to build resilient,...

CVE-2026-28139: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

PT-2026-68615

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25 Description A path traversal issue exists within the ludus environment guides search component, specifically in a function located in the src/tools/ludusEnvironmentGuidesSearch.ts file. This occu...

EulerOS 2.0 SP13 : sqlite (EulerOS-SA-2026-3051)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a...

PT-2026-75910

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...

EulerOS 2.0 SP13 : sqlite (EulerOS-SA-2026-3001)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a...

GHSA-4XRF-JV44-H6HH vulnerabilities

Vulnerabilities for packages: lerna, opensearch-dashboards, sqlpad, npm, renovate, langfuse, prism, code-server, kubeflow-pipelines, saf, pulumi...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.14 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.14 and Red Hat build of Keycloak 26.4.14 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions

A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions FGAPv2 are enabled, an administrator who should only be able to search for users but not view their full details can use a...