RHEL 10 : gpsd (RHSA-2026:51075)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51075 advisory. gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the...

CVE-2026-67689

CVE-2026-67689 concerns FineAdmin V1.0 where the vulnerability arises in the paginated list endpoints through the field and order parameters, enabling SQL injection via unsafely constructed ORDER BY clauses. Connected sources describe that FineAdmin.Mvc’s GetListByFilter()/GetPageUnite() concaten...

Linux Distros Unpatched Vulnerability : CVE-2026-71212

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xidown a yt-dlp/ffmpeg GUI wrapper builds its yt-dlp command-line invocation xidown/core/scanner.py and downloader.py by appending the user-provided or scanned...

RHEL 9 : gpsd-minimal (RHSA-2026:51153)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51153 advisory. gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the...

CVE-2026-67688

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

CVE-2026-67688

ICS-Park Smart Park Management System v2.0 is affected by an unrestricted file upload vulnerability in the file upload module, enabling a remote attacker to upload arbitrary files and potentially achieve remote code execution. The CVE entry rates this as CRITICAL (CVSS 3.1: 9.8) with network acce...

RHEL 9 : systemd (RHSA-2026:51134)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51134 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-2998)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

Schneider Electric SCADAPack and RemoteConnect Improper Check For Unusual or Exceptional Conditions (CVE-2026-0667)

CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause remote code execution, denial of service, and loss of confidentiality and integrity of the RTU controller when an unauthenticated attacker sends specially crafted Modbus TCP packets to the device...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

EUVD-2026-53684

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531

CVE-2026-67531 affects FrontMCP before 1.5.7. The sandboxed codecall:execute tool could leak live host Zod schema instances to scripts via getTool, and due to Zod v4 _zod being non-configurable/non-writable, the ECMAScript Proxy invariant returned the raw host object. This allowed a script to rea...

CVE-2026-71319

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

NPM: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.4.0, 3.21.10...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

EUVD-2026-53648

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools development mode only exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the...