1660 matches found
CVE-2026-94046
A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...
CVE-2026-94046
ACE-MCP (version up to 4.10.8) contains a path traversal vulnerability in the get_file_snippet function of getFileSnippet.ts within its MCP Tool component. The root cause is that isPathInsideProjectRoot only validates that filePath does not escape the projectRootPath, but projectRootPath itself i...
CVE-2026-94046 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal
A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...
EUVD-2026-83780
A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...
CVE-2026-94046 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal
A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...
CVE-2026-94046 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal
A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...
CVE-2026-94046: Improper Limitation of a Pathname to a Restricted Directory
A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...
PT-2026-96003
Name of the Vulnerable Software and Affected Versions 0215AndrewFeng ACE-MCP versions prior to 4.10.9 Description A path traversal issue exists in the MCP Tool component within the get file snippet function of the getFileSnippet.ts file. This flaw allows a remote attacker to access files outside...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Corrected the incorrect validation of the numaces field in smbacl. parsedcal now validates numaces to allocate an array of posixacestatearray. If numaces is greater than ULONGMAX / sizeofstruct smbace++, it results in a...
CVE-2026-71940 DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causi...
CVE-2026-71940
DrayTek VigorSwitch multiple models contain a buffer overflow in the acl_general_setup Edit ACE function, caused by copying the name field into a fixed-size buffer without length validation. A remote attacker with valid administrative credentials for the device's web management interface can trig...
EUVD-2026-64999
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the aclgeneralsetup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causi...
PT-2026-80974
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl general setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input,...
CVE-2026-72382
A flaw was found in ksmbd in the Linux kernel. A remote attacker, by sending a specially crafted security descriptor with an undersized Discretionary Access Control List DACL during an SMB2SETINFO operation, can trigger an integer underflow. This underflow leads to excessive memory allocations fo...
Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation
Stitching the Kill Chain: Detecting NTDS.dit Exfiltration with Trellix Helix Correlation By Adithya Chandra and Maulik Maheta · August 18, 2026 Executive Summary While attackers continuously cycle through new tooling, their underlying techniques remain remarkably consistent. Credential theft from...
UBUNTU-CVE-2026-72382
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...
EUVD-2026-59281
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parsedacl limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL size field is 16 bits, but the expression...
SUSE CVE-2026-68100
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...
SUSE CVE-2026-68098
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...
