CVE-2026-77825: Improper Limitation of a Pathname to a Restricted Directory

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

PT-2026-97837

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement chec...

PT-2026-97645

Name of the Vulnerable Software and Affected Versions SPON Communications IP Network Audio Device XC-9603 version 1.2.3 20181106 Build 107 Description A remote information disclosure issue exists within the Configuration File Download component. The flaw is located in the loadCfg function when...

AMD Zynq™ UltraScale+ MPSoC and RFSoC Devices – Secure Boot Bypass via Unbounded DFU Download Requests

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0461| Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded Device Firmware Upgrade DFU download...

CVE-2026-96673

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

openssh security, bug fix, and enhancement update

8.0p1-33.0.1 - Update upstream references Orabug: 36587718 8.0p1-33 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-248257 8.0p1-32 - Improve fix for CVE-2023-38408, avoid invoking constructors on dlopen Related: RHEL-234763 8.0p1-3...

CVE-2026-96673: Improper Neutralization of Special Elements used in an SQL Command

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

PT-2026-97359

Name of the Vulnerable Software and Affected Versions Photoview versions prior to 2.4.1 Description An SQL injection issue exists in the album download route. Unauthenticated attackers can inject SQL by manipulating the album id path segment. By supplying crafted SQL expressions in the album id...

GHSA-VV3M-F8X4-7377 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

Summary LightRAG's native markdown parser downloads external images referenced by an uploaded markdown or textpack document. The only SSRF guard, validatedaddresses in lightrag/parser/markdown/parser.py, resolves the image host and rejects it when the resolved IP is not isglobal. That check is...

CVE-2026-85740 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

EUVD-2026-84549

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

CVE-2026-85740 LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

CVE-2026-95653

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-80151

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-80151

Lantronix Autonomous Out-of-Band Devices (SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02) are affected by an OS command injection in the set nfs download command, which passes unsanitized user input to a system() call. Authen...