CVE-2026-19368 PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal

A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component geminisearch/geminireason/geminiprocess/geminianalyze. The manipulation of the argument filepath/filepaths results in path...

EUVD-2026-54935

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

CVE-2026-19326 Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

CVE-2026-19326

CVE-2026-19326 affects Jevon-Zhong Ai-doctor 0.0.1. The vulnerability is in the deleteImage function of ai-doctor-server/src/filemanagement/filemanagement.service.ts, where manipulating the imagePath argument enables path traversal. Local access is required. The project was informed via an issue ...

EUVD-2026-54853

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

PT-2026-69299

Name of the Vulnerable Software and Affected Versions 3CORESec Trapdoor versions prior to 1.2.3 Description Improper access controls exist in the DefaultFunction function, which allows a remote attacker to manipulate the system. Recommendations Update 3CORESec Trapdoor to version 1.2.3 or later. ...

Linux Distros Unpatched Vulnerability : CVE-2026-19017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA...

CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...

CVE-2026-71951

D-Link DWR‑M961 devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108 are affected by a remote command‑injection in the /boafrm/formIMEISetup interface. The vulnerability allows an attacker to inject commands via the IMEI_value field, resulting in command execution with roo...

CVE-2026-71947

CVE-2026-71947 affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. The vulnerability resides in the /boafrm/formTracerouteDiagnosticRun interface, where a remote attacker can inject commands via the host and ipVer fields, leading to command exec...

CVE-2026-19263

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It i...

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-44092

A flaw was found in ModbusServer. An unauthenticated remote attacker can inject malicious input into the application due to a lack of input validation when fetching data from MQTT. This vulnerability may lead to a loss of data integrity and system availability...

CVE-2026-18363

A flaw was found in osTicket. A logic vulnerability in the password reset token validation routine allows an attacker to bypass the intended expiry validation. By obtaining and reusing a valid password reset token, a remote attacker can perform an unauthorized password reset, leading to the...

Linux Distros Unpatched Vulnerability : CVE-2026-54338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators c...

EulerOS 2.0 SP11 : krb5 (EulerOS-SA-2026-3072)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system with a NegoEx...

PT-2026-69200

Name of the Vulnerable Software and Affected Versions astralisone rive-mcp-server-core versions up to db1d0cc4cd52589116360428b7504fd0ca748b3e Description A path traversal issue exists in the importRiveFile Flow component within the file packages/mcp-server/src/tools/importRiveFile.ts. A local...

SUSE CVE-2026-19137

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

SUSE CVE-2026-19147

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-19166

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...