CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

Johnson Controls Inc. TL280

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

Medixant RadiAnt DICOM

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

SUSE CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-19027

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

EulerOS 2.0 SP13 : python-urllib3 (EulerOS-SA-2026-3044)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

EulerOS 2.0 SP13 : python-urllib3 (EulerOS-SA-2026-2994)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

The vulnerability of the switchtec_ntb_init_mw() function in the drivers/ntb/hw/mscc/ntb_hw_switchtec.c driver for Linux’s non-visible kernel bridges allows a attacker to access protected information or cause service failures.

The vulnerability of the switchtecntbinitmw function in the drivers/ntb/hw/mscc/ntbhwswitchtec.c driver for Linux’s non-visible kernel bridges is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or cause service...

The vulnerability of the kfd_event_page_set() function in the drivers/gpu/drm/amd/amdkfd/kfd_events.c driver for the Direct Rendering Infrastructure (DRI) of AMD graphics cards in Linux operating systems allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the kfdeventpageset function in the drivers/gpu/drm/amd/amdkfd/kfdevents.c module of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to out-of-buffer writing. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the scarlett2_usb_get_config() function in the sound/usb/mixer_scarlett2.c module, which supports USB audio devices in Linux operating systems, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the scarlett2usbgetconfig function in the sound/usb/mixerscarlett2.c module, which supports USB audio devices in Linux operating systems, is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the spectre_bhb_loop_affected() function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the spectrebhbloopaffected function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, relates to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to cau...

EulerOS 2.0 SP13 : python-pip (EulerOS-SA-2026-2993)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

The vulnerability of the bond_enslave() function in the drivers/net/bonding/bond_main.c file of the Linux kernel-based network device driver allows a attacker to access protected information or cause service failure.

The vulnerability of the bondenslave function in the drivers/net/bonding/bondmain.c file of the Linux kernel network device driver is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or...

EulerOS 2.0 SP13 : dnsmasq (EulerOS-SA-2026-2963)

According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

EUVD-2026-53684

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531

CVE-2026-67531 affects FrontMCP before 1.5.7. The sandboxed codecall:execute tool could leak live host Zod schema instances to scripts via getTool, and due to Zod v4 _zod being non-configurable/non-writable, the ECMAScript Proxy invariant returned the raw host object. This allowed a script to rea...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-71316

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...

NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients vulnerability discovered by ? in WordPress Npm nuxt versions = 4.4.0, = 4.5.0...