GHSA-6F9W-9HF2-5RG3 CKAN MCP Server: Information disclosure via verbose error reflection

Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...

CKAN MCP Server: Information disclosure via verbose error reflection

Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...

CVE-2026-85168

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...

CVE-2026-85168 n8n before 1.123.73 Remote Code Execution via Git Node

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...

EUVD-2026-70403

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...

CVE-2026-85168 n8n before 1.123.73 Remote Code Execution via Git Node

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...

CVE-2026-85168 n8n before 1.123.73 Remote Code Execution via Git Node

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...

CVE-2026-85168

n8n versions before 1.123.73 , 2.35.4 , and 2.36.2 are affected by a remote code execution vulnerability in the Git node . The root cause is that the node's sanitization logic reset a fixed list of command-bearing Git configuration keys but did not cover the content-filter and merge-driver key fa...

Exploit for CVE-2026-78071

Stored XSS via Location Title in DPCalendar Free DPCalendar...

Exploit for CVE-2026-78070

SQL Injection via ORDER BY Shortcode in plgcontentdpcalendar...

vigolium v0.4.4

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

...

CVE-2026-73812

A flaw was found in the inets httpd server, part of Erlang/OTP. The server incorrectly processes HTTP requests that contain both Transfer-Encoding: chunked and Content-Length headers, failing to reject them or close the connection as required by RFC 9112 §6.1. When inets is deployed behind a...

SUSE CVE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-85000

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with...

PT-2026-85080

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

TencentOS Server 4: webkitgtk (TSSA-2026:0965)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0965 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-84380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request.prepare in src/httpx2/httpx2/models.py can add a body-derived Content-Length header...

PT-2026-85135

Name of the Vulnerable Software and Affected Versions OpenList versions prior to 4.2.3 Description The offline-download feature at the 'POST /api/fs/add offline download' endpoint is susceptible to path traversal when using the tool: "SimpleHttp" configuration. The application accepts a...

PT-2026-85302

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description MOOSDB HTTP pages fail to escape database contents during rendering, leading to stored cross-site scripting. This allows a MOOS publisher to set variable values containing malicious script...