CVE-2026-79743

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

EUVD-2026-68691

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

Directory Traversal

Overview @theia/ai-ide is an AI IDE Agents Extension Affected versions of this package are vulnerable to Directory Traversal through the AI Agent Mode file-change tools in the workspace path resolution code. An attacker can write or delete files outside the workspace by supplying a crafted relati...

SUSE CVE-2026-59681

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration values to execute arbitrary commands as root on the configured host. Auth::AuthConf in src/lib/auth/authconf.rb assembles the Samba net ads join, net ads lookup -S and net ads...

Directory Traversal

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: Update to version 3.1.25. CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776. Patch Instructions: To install this SUSE update use the SUS...

SUSE-SU-2026:3890-1 Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: - CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776...

Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: Update to version 4.4.5. CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:3889-1 Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: - CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776...

Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: Update to version 4.5.4. CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:3888-1 Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: - CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776...

Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: Update to version 4.6.2. CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:3887-1 Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: - CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776...

Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: Update to version 4.7.2. CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:3886-1 Security update for yast2-samba-client

This update for yast2-samba-client fixes the following issue: - CVE-2026-25706: OS command injection via attacker-controlled Organizational Unit Active Directory-supplied during interactive domain join bsc1272776...

CVE-2026-82877 ILIAS Arbitrary File Read via SOAP addFile

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import...

USN-8691-1: attr vulnerability

It was discovered that attr incorrectly handled symbolic links while traversing directory paths. A local attacker who controlled a pathname component could possibly use this issue to redirect privileged attr operations to arbitrary files and gain elevated privileges...

NoiseHound v1.2.0

NoiseHound Detection-aware Active Directory attack-path scoring. DreadHost Research | companion to OffsetInspect PowerShell and OffsetScan Rust BloodHound and PlumHound on top of it finds a path to the objective. NoiseHound ingests the same graph data and re-ranks paths by expected detection cost...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2026-79743: Improper Limitation of a Pathname to a Restricted Directory

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...