CVE-2026-57441

MCPVault , a lightweight Model Context Protocol server for safe file access in an Obsidian vault , contains a path-filter bypass in PathFilter (src/pathfilter.ts) prior to 0.11.4 . The deny-list for restricted directories (.git, .obsidian, node_modules) is compiled case-sensitively and compared w...

CVE-2026-58483 mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread in src/index.ts passes a caller-supplied URL to readUrlContent in src/url-reader.ts, where checkContentLength treats a missing Content-Length...

CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-54689

CVE-2026-54689 affects mcp-searxng , a Model Context Protocol (MCP) server providing AI assistants with web search and URL-reading via SearXNG. The vulnerability lies in the hardened-mode SSRF protection in src/url-reader.ts: when MCP_HTTP_HARDEN is enabled and private URLs are not explicitly all...

CVE-2026-54689 mcp-searxng hardened-mode SSRF bypasses permit internal URL access

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

EUVD-2026-78914

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56829

Shopper (a headless e-commerce admin panel) prior to 2.9.2 has an authorization bypass in the Livewire VariantStock component. The stockAction() method lacks an edit_product_variants permission check, and the public $variant property is missing the #[Locked] attribute, making it client-mutable vi...

EUVD-2026-78913

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...

CVE-2026-56825

Shopper (a headless e-commerce admin panel) is vulnerable to an authorization bypass in the CollectionProducts Livewire component prior to v2.9.2 . Two defects combine: the per-record and bulk delete actions lack an ->authorize(...) guard, and the public $collection property is not marked #[Lo...

EUVD-2026-78909

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing...

CVE-2026-12910

CVE-2026-12910 is a missing authentication enforcement issue in GitLab CE/EE affecting versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . Under certain conditions, an authenticated user could bypass SAML SSO sign-in restrictions and authenticate without SSO due to miss...

EUVD-2026-78898

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

CVE-2026-11918

IBM ContextForge MCP Gateway (versions ≤ v1.0.4) is vulnerable to a security filter bypass in its regex_filter and deny_filter plugins. The root cause (CWE-184) is that these plugins' scanning loops only inspect top-level keys of payload.args without recursive traversal, allowing an authenticated...

CVE-2026-53459 Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

CVE-2026-53459

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. A fail-open flaw in the authentication code (introduced in version 0.1.6, fixed in 0.2.4.4) allows an unauthenticated, remote attacker to flood a public endpoint, exhausting resources until database access fa...

NetSec-CVE-2023-4357

Network Security Project — CVE-2023-4357 Overview This project is a final project for a Network Security course. The project focuses on CVE-2023-4357, a vulnerability affecting Google Chrome versions prior to 116.0.5845.96. The vulnerability is related to the handling of XML/XSLT and can allow a...

CVE-2026-48785

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785

In Apptainer (open-source container platform) prior to v1.5.1 , the limit container paths directive in apptainer.conf uses plain string-prefix matching in Image.AuthorizedPath. This means an allowed path such as /data/safe also authorizes a sibling like /data/safe-but-unsafe, allowing a local use...