EUVD-2026-44455

AWS HealthLake MCP Server awslabs.healthlake-mcp-server is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all...

CVE-2026-15643

AWS HealthLake MCP Server awslabs.healthlake-mcp-server is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all...

CVE-2026-55144 Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability

...

CVE-2026-55144 Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability

...

Security Bulletin: IBM Engineering Lifecycle Management - Doors Next is impacted by vulnerabilities

Summary A vulnerability has been identified in poi-ooxml library, which is used in IBM Engineering Lifecycle Management - Doors Next. Vulnerability Details CVEID:CVE-2025-31672 DESCRIPTION: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files...

The vulnerability of the tr.Next() method in the container management system and the Incus virtual machine manager allows a attacker to trigger a service failure.

The vulnerability of the tr.Next method in container management systems and the Incus virtual machine manager is related to pointer manipulation. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PT-2026-58721

AWS HealthLake MCP Server awslabs.healthlake-mcp-server is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS awslabs.healthlake-mcp-server before 0.0.14 on all...

CVE-2026-59801

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...

MAL-2026-10460 Malicious code in datavaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf831f155eb2a6d04427e5cc3cd239055844e80c3b02576a5d546e4e7ab42b6 On require of the package's main entry auth.js - lib/writer.js, the module attempts require'auth-gen-next'; on failure it invokes execSync'npm instal...

Malicious code in datavaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf831f155eb2a6d04427e5cc3cd239055844e80c3b02576a5d546e4e7ab42b6 On require of the package's main entry auth.js - lib/writer.js, the module attempts require'auth-gen-next'; on failure it invokes execSync'npm instal...

Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint

SummaryAn open redirect vulnerability in the account confirmation endpoint allows an unauthenticated attacker to craft a URL hosted on a legitimate Kiwi TCMS instance that redirects victims to an arbitrary external domain. The attack surface is particularly relevant for phishing campaigns targeti...

PYSEC-2026-3065 Shamefile has an arbitrary file read via shamefile.yaml in shame next

Impact A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. Patches Fixed in 0.1.7. Upgrade to...

Shamefile has an arbitrary file read via shamefile.yaml in shame next

ImpactA path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. PatchesFixed in 0.1.7. Upgrade to eithe...

PT-2026-59028

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the is safe url check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a...

The vulnerability of the PlatformHandler.axd handler in the “Project-SMARTPRO” software platform and the “S-SMARTPRO” software suite is related to an incorrect limitation on the path name to the catalog. This allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PlatformHandler.axd component in the automated information system “Web-Torghi KS” and the software suite “Budget-NEXT” is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability can allow a malicious actor to gain unauthorized...

PT-2026-59685

Impact A path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See patch commit for technical details. Patches Fixed in 0.1.7. Upgrade to...

PT-2026-86939

Уязвимость обработчика PlatformHandler.axd автоматизированной информационной системы «Web-торги КС» и программного комплекса «Бюджет-NEXT» связана с неверным ограничением имени пути к каталогу. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный...