CVE-2026-106218

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible...

CVE-2026-67270

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

EUVD-2026-93496

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu anti-forgery parameter in crayonsstore.php, causing the authorization dispatcher to resolve an...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.10 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-14532 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a Reader-role attacker to obtain version information that causes an uncaught...

EUVD-2026-93491

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAut...

GHSA-6QXP-VCCF-F47H MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server...

@1mcp/agent (>=0.38.0, <=0.39.0-beta.3), @3ngram/server (>=1.1.0, <=1.8.5) +72 more potentially affected by CVE-2026-104850 via @modelcontextprotocol/server-legacy (>=2.0.0, <=2.1.0)

@modelcontextprotocol/server-legacy NPM version =2.0.0, =0.38.0, =1.1.0, =0.3.8, =0.5.0, =2.0.0, =0.59.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =3.1.0 and more Source cves: CVE-2026-104850 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSERVERLEGACY-20579867...

MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received the client's OAuth credentials. Credentials were not tied to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server...

CVE-2026-63688

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-63688

Dell Container Storage Modules CSM, versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to...

CVE-2026-104069

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit a heap-based buffer overflow vulnerability in the negosendnegotiationrequest function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled LoadBalanceInfo field, the serve...

Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

EUVD-2026-93458

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

CVE-2026-67270

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

CVE-2026-67270

Dell Container Storage Modules (CSM) versions prior to 1.18.0 are affected by an Improper Certificate Validation vulnerability within the proxy-server component. An unauthenticated attacker located on an adjacent network could exploit this flaw to cause information exposure of storage backend adm...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

EUVD-2026-93436

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069 HortusFox < 6.2 Remote Code Execution via Theme Import

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafte...

CVE-2026-104069

HortusFox versions prior to 6.2 are vulnerable to Remote Code Execution (RCE) via the ThemeModule::startImport() function. The root cause is the direct extraction of uploaded ZIP archives into the public web root without validating filenames, extensions, or content. An authenticated administrator...