CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

CVE-2019-6329

Local Privilege Escalation in HP Support Assistant A local privilege escalation bug in HP Support Assistant by abusing hard link Researcher: ManhNDd of Bkav Description In HP Support Assistant GUI , when you click Check for updates and messages , the service HP Support Solution Framework will run...

CVE-2023-49471

CVE-2023-49471 Vulnerability Type Blind SSRF Affected Product and Version Bar assistant / -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name="images0copyright" ------------------------...

mcp-server

Offensive360 MCP 服务器 在您的 AI 助手中运行 Offensive360 SAST 扫描。 这个 Model Context Protocol 服务器为 Claude Code、 Claude Desktop、Cursor 以及任何其他 MCP 客户端提供两个工具： 工具| 功能 ---|--- o360scanpath| 压缩本地目录，运行完整的 SAST 扫描（支持 60+ 种语言、污点/数据流分析），返回包含文件/行号、严重级别和修复建议的发现结果 o360scanstatus| 正在运行的扫描的队列位置 向您的助手提问，例如 "使用 Offensive360...

CVE-2026-54561

MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, contextimport in src/index.ts passes the caller-controlled filePath directly to fs.readFileSync without restricting the path to an export directory. An MCP client, including an LLM agent...

CVE-2026-55236

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-55236

CVE-2026-55236 is an incomplete authorization flaw in langgraph-api (the LangGraph Server runtime) prior to version 0.10.0. The run-creation path dispatched the assistants.search authorization event with an incomplete value instead of assistants.read , so in deployments whose custom resource hand...

CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-55236 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value instead of the assistants.read event used by direct reads and cro...

CVE-2026-6642

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

CVE-2026-6641

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

CVE-2026-6640

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6642

The Media Library Assistant WordPress plugin (versions up to and including 3.35 ) is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism. The root cause is insufficient output escaping in the mla_generate_bulk_edit_form_fieldsets() function and the mla-bulk-...

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-76009

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6640

The Media Library Assistant WordPress plugin is vulnerable to Stored Cross-Site Scripting via the mla_link_attributes parameter in all versions up to and including 3.35 , caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher...

CVE-2026-6642 Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

EUVD-2026-76008

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

CVE-2026-6641

Media Library Assistant is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.35 . The flaw resides in the mla_gallery shortcode: when the mla_output parameter is set to paginate_links, the mla_link_href parameter is processed by _paginate_links()...

CVE-2026-6641 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...