avaintegration-metapackage (>=6.0.4.3, <=6.0.5.36), bravoserver (3.1.0) +37 more potentially affected by CVE-2026-48587 via django (>=6.0.0, <=6.0.5)

django PYPI version =6.0.0, =6.0.4.3, =2.0.0, =1.1.0, =0.70.2, =0.1.0b2, =0.1.2, =0.1.4 and more Source cves: CVE-2026-48587 Source advisory: OSV:PYSEC-2026-198...

Brave Desktop 1.91.168 Security Fixes

Added the ability to disable or delay automatic extension updates when brave://flags/brave-user-extension-auto-update is enabled. Upgraded Chromium to 149.0.7827.54 — refer to Google Chrome advisories for inherited CVEs...

Server-side Request Forgery (SSRF)

Overview @wonderwhy-er/desktop-commander is a MCP server for terminal operations and file editing Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the readFileFromUrl function in filesystem.ts when processing the url argument. An attacker can access interna...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10691 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10691 Source advisory:...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10690 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10690 Source advisory:...

GHSA-5XX3-J724-WMX5 DesktopCommanderMCP is vulnerable to SSRF

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component readfile. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10691 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10691 Source advisory: OSV:GHSA-R87G-78MX-3WG...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10690 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10690 Source advisory: OSV:GHSA-5XX3-J724-WMX...

EUVD-2026-34056

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

EUVD-2026-34033

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0...

CVE-2026-10690

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component readfile. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

Docker Desktop grpcfuse Kernel Module Uncontrolled Recursion Denial-of-Service Vulnerability

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code within a container on the target system in order to exploit this vulnerability. The specific flaw...

Desktop Commander MCP 安全漏洞

Desktop Commander MCP is an MCP server developed by Eduard Ruzga. Version 0.2.37 of Desktop Commander MCP contains a security vulnerability. This vulnerability stems from the handling of the url parameter in the readFileFromUrl function found in the src/tools/filesystem.ts file. This vulnerabilit...

Desktop Commander MCP 安全漏洞

Desktop Commander MCP is an MCP server developed by Eduard Ruzga. Versions of Desktop Commander MCP prior to 0.2.38 contained security vulnerabilities. These vulnerabilities stemmed from the operation of the startsearch component in the src/search-manager.ts file with respect to the SearchResult...

CVE-2026-10691 wonderwhy-er DesktopCommanderMCP start_search search-manager.ts redos

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

CVE-2026-10691

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

CVE-2026-10690 wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the component readfile. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote...

CVE-2026-8936

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0...

CVE-2026-8936 Unbounded recursion in grpcfuse kernel module allows container to crash Docker Desktop VM

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0...

CVE-2026-8936

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested directories on a bind-mounted host folder and triggered a dentry invalidation event. This issue has been fixed in Docker Desktop 4.76.0...