57908 matches found
EUVD-2026-54769
A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...
CVE-2026-19270 Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal
A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...
GHSA-WCX4-WPFV-MC5C
creationtimestamp| type| source ---|---|--- 2026-08-08 07:36:05+00:00| seen| https://gist.github.com/alon710/990635ffdd01b8358cf96c18cad137b7...
CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection
A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...
CVE-2026-47127
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...
CVE-2026-47127 Ghostfolio has a Stripe subscription bypass
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...
CVE-2026-47127 Ghostfolio has a Stripe subscription bypass
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...
CVE-2026-47127
Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at GET /api/v1/subscription/stripe/callback?checkoutSessionId= retrieves the Stripe Checkout Session by ID and unconditionally grants a Premium subscription to the...
CVE-2026-19246 HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function downloadimagedataurl of the file nanobot/providers/imagegeneration.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the...
CVE-2026-19229
A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /notes/ of the component Dreamweaver Metadata Files. Executing a manipulation can lead to file and directory information exposure. The attack can be launched...
CVE-2026-47364
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out. Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own...
CVE-2026-44965
Datadog’s Android app is affected by CVE-2026-44965, involving six App Widget configuration activities (IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity) that are exported with no permission g...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
EUVD-2026-54567
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
CVE-2026-19229
The CVE-2026-19229 entry concerns SourceCodester Online Clothing Store. Affects an issue in the "/_notes/" component handling Dreamweaver Metadata Files where manipulation of that area can disclose file and directory information. The vulnerability is exploitable remotely, and the exploit has been...
SUSE CVE-2026-71437
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...
CVE-2026-19210
A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=saveupload. Such manipulation of the argument img/imgName leads to unrestricted upload. The attack may be launched remotely. The exploit has be...
CVE-2026-19208
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FIDJYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is...