CVE-2026-53937

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

PT-2026-88909

Name of the Vulnerable Software and Affected Versions bubblewrap versions prior to 0.12.0 Description A flaw exists during sandbox setup where creating files or directories under the new root can follow a parent symlink onto the host via /oldroot. This allows the launching user to write...

PT-2026-105472

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-239g-whfq-7xj9. This link is maintained to preserve external references. Original Description GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the...

CVE-2026-87817: Improper Control of Generation of Code

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

Linux Distros Unpatched Vulnerability : CVE-2026-87817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like...

PT-2026-89001

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS COMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

Linux Distros Unpatched Vulnerability : CVE-2026-87766

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot,...

RHEL 8 : glib2 (RHSA-2026:65762)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65762 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 10 : glib2 (RHSA-2026:65767)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65767 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 9 : glib2 (RHSA-2026:65768)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65768 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 8 : glib2 (RHSA-2026:65769)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65769 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 7 : glib2 (RHSA-2026:65773)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65773 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

CVE-2026-53937 MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)

MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol. In versions 0.7.0 through 0.12.0, ReadBuffer.append in kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt writes every chunk of bytes received from the...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 Marimo Pre Authentication RCE --- 📋 V...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Proftpd

CVE-2010-4221 — ProFTPD TELNET IAC Stack Overflow: From Patch...

CVE-2026-12645

CVE-2026-12645 is a Missing Authorization vulnerability in Ivanti Neurons for ITSM affecting versions before 2026.2 . A remote authenticated attacker can leverage this flaw to execute arbitrary code on the server, with the scope changed and high impact on confidentiality, integrity, and availabil...

CVE-2026-47892

A flaw was found in Spring Framework. This vulnerability allows a header predicate bypass to occur in a pre-flight request within a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. This bypass could potentially lead to unexpected behavior or security poli...

kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memor...

kernel: nvmet-auth: validate reply message payload bounds against transfer length

A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF NVMe over Fabrics authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the...

CVE-2024-20154

CVE-2024-20154: Desbordamiento de pila NB-IoT SIB1-NB en la banda base MediaTek MT6769 Clasificación: CWE-121 — Desbordamiento de búfer basado en pila Gravedad: Crítica boletín de MediaTek · 8.8 Alta, Vector de ataque: Adyacente CISA-ADP Tipo: Ejecución remota de código — sin interacción del...