68465 matches found
openjdk: Enhance Jar handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...
PYSEC-2026-3478 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
Impact LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint. A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In...
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
SummaryIn affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...
PYSEC-2026-3489 netlicensing-mcp: REST Path Traversal Bypasses Token Redaction
REST Path Traversal Bypasses Token Redaction in netlicensing-mcp Summary The netlicensinggetproduct MCP tool in netlicensing-mcp interpolates a caller-controlled productnumber argument directly into a REST URL path without any validation. Passing ../token as the product number causes httpx to...
PYSEC-2026-3516 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
Summary An unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agentfile field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs. Details The agentfile field in...
EUVD-2026-48226
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...
CVE-2026-65535
Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...
CVE-2026-65535
CVE-2026-65535 concerns the WordPress TinyMCE Templates plugin, specifically versions
EUVD-2026-48123
Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...
CVE-2026-65521
Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-65521.
CVE-2026-65521
Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...
CVE-2026-65521 WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...
CVE-2026-65521 WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...
CVE-2026-65505 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
EUVD-2026-48114
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-65505
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...
CVE-2026-65505
CVE-2026-65505 concerns WordPress sites using the Ultimate Store Kit Elementor Addons plugin, affected versions
CVE-2026-65505 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...