mcp-stdio-shellguard

Teil desStudioMeyer MCP Stack — Entwickelt auf Mallorca 🌴 · ⭐ wenn du es nutzt mcp-stdio-shellguard Defense-in-depth-Bundle für MCP-stdio-Server. Ummantelt childprocess.exec/spawn mit Allowlist + Sandbox + Replay-Erkennung, plus ein AST-Audit-CLI mcp-shellguard-audit, das MCP-Serverquellen auf...

CVE-2026-80213

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...

CVE-2026-55584

CVE-2026-55584 - phpSysInfo IP-Whitelist-Umgehung CWE-290, CVSS 7.5 High, phpSysInfo = 3.4.5 Referenzen: GHSA-786w-p5pm-cvgh, CVE.org PSIALLOWED löst die Client-IP aus den vom Angreifer kontrollierten Headern X-Forwarded-For dann Client-IP auf, bevor auf REMOTEADDR zurückgegriffen wird. Es gibt...

CVE-2026-80213

CVE-2026-80213 affects the resolv gem (before 0.7.2 ) for Ruby. The vulnerability resides in Resolv::DNS::MessageEncoder , which wrote a DNS label's length into a single octet without range validation. Labels longer than 255 octets had their length stored modulo 256 while the label data was writt...

CVE-2026-80213

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...

EUVD-2026-67139

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length into a single octet without checking its range. A label longer than 255 octets had its length stored modulo 256 but the label data was written unchanged, and thus the bytes on t...

log4j-4255

log4j2 4255 — Bypass della allowlist di FilteredObjectInputStream tramite java.rmi.MarshalledObject Un laboratorio autonomo e containerizzato che riproduce end-to-end l'issue Apache log4j24255 utilizzando gli artefatti ufficiali Log4j 2.26.1 su JDK 17 , con controlli positivi, un oracle indurito ...

CVE-2026-59275

Spring AMQP versions 4.1.0, 4.0.0–4.0.4, 3.2.0–3.2.12, and 2.4.18 and earlier are affected by a remote JVM termination vulnerability. A single hostile AMQP message triggers nested-array Java deserialization that bypasses the allowlist, causing a StackOverflowError . The default JavaLangErrorHandl...

CVE-2026-59275 Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

A single hostile AMQP message can terminate the entire consumer JVM System.exit99, not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

CVE-2026-47875

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

sanitize

Sanitize Sanitize è un sanitizzatore HTML e CSS basato su allowlist. Rimuove tutto l'HTML e/o CSS da una stringa, tranne gli elementi, gli attributi e le proprietà che scegli di consentire. Utilizzando una semplice sintassi di configurazione, puoi dire a Sanitize di consentire determinati element...

netfence

Netfence Come Envoy xDS, ma per filtri eBPF. Netfence funge da demone sui tuoi host VM/container e inietta automaticamente programmi di filtro eBPF nei cgroups e nelle interfacce di rete, con un server DNS integrato che risolve i domini consentiti e popola la lista di IP consentiti. I demoni di...

CVE-2026-80349

TarsWeb through 3.0.14 contains a critical authentication bypass (CVSS 9.8). The root cause is a combination of two misconfigurations: Koa's proxy option is set to true without restricting trusted upstream proxies, so the source address is taken from the caller-controlled X-Forwarded-For header; ...

skillscript

Automazione sicura e riutilizzabile, creata da agenti. skillscript.ai • documentazione TL;DR — npm install -g skillscript-runtime && skillfile init && skillfile dashboard. Vedi Avvio rapido. Cos'è Skillscript? Skillscript nasce dalla domanda: come sarebbe un Makefile se costruisse competenze inve...

PT-2026-82067

Name of the Vulnerable Software and Affected Versions TarsWeb versions prior to 3.0.16 Description TarsWeb incorrectly determines if a request originates from a trusted local caller by relying on a client-controlled header. The app.js file enables the Koa proxy option without specifying trusted...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

sudowp-postgallery

SudoWP PostGallery Fork de Segurança Contribuidores: SudoWP, WP Republic Autores Originais: RTO GmbH Tags: galeria, segurança, corrigido, cve-2025-13543 Requer pelo menos: 5.8 Testado até: 6.7 Tag estável: 1.12.6 Licença: GPLv2 ou posterior Aviso de Segurança Este é um fork endurecido contra...