CVE-2026-102476

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and...

EUVD-2026-101530

In Eclipse Vert.x versions 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the Vert.x HTTP client relies on an SSL context for efficiency purpose, the key of this cache should reflect entirely the SSL semantics of the desired SSL properties. It is possible for a client to ask for an SSL context and...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527

The Model Context Protocol Python SDK is vulnerable to a memory exhaustion Denial of Service (DoS) in versions before 1.29.1 and from 2.0.0a1 through 2.0.1 . The vulnerability exists because the Streamable HTTP session manager , SSE message endpoint , and OAuth authorization-server routes buffer ...

EUVD-2026-101514

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

EUVD-2026-101503

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395

The Model Context Protocol Java SDK is vulnerable to memory exhaustion due to unbounded request bodies in certain server transports. Specifically, the Servlet-based SSE , Streamable HTTP , and Stateless server transports fail to enforce a maximum size when reading HTTP request bodies into memory....

CVE-2026-75083

The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41zrx in drivers/ieee802154/ieee802154kw41z.c, computed the payload size as pktlen = len - KW41ZFCSLENGTH in a uint8t, where len is the frame length reported by the radio. The interrupt handler kw41zisr obtained that length from the...

CVE-2026-77572

VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local use...

CVE-2026-77572 VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt

VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows veracrypt.sys driver accept caller-supplied object-manager and device paths broader than supported VeraCrypt workflows require. A local use...

CVE-2026-101025

Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...

CVE-2026-73539 Gitea external renderer argument injection and code execution

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On...

CVE-2024-48652

CVE-2024-48652 Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field Steps to Reproduce: 1.Open the URL: http://127.0.0.1/admin/dashboard 2.Log in using admin credentials. 3.Navigate to the "Settings" section...

reproducing-CVE-2025-1489

Reproducing CVE-2025-1489 This repository simulates a reproduction of a web-related CVE CVE-2025-1489 in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills. The vulnerability identified and reproduced is a stored cross-site scripting XSS vulnerability in the...

CLEANSTART-2026-UX87470 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression

CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...

CVE-2026-100111 Photoshop Desktop | Out-of-bounds Write (CWE-787)

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-103836 Substance3D - Stager | Out-of-bounds Write (CWE-787)

Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...