CVE-2026-19284 MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...

EUVD-2026-54778

A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function loadpdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was inform...

CVE-2026-19270

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...

CVE-2026-19270 Hulupeep mcp-ui-probe Journey/Usage JourneyStorage.ts usage_stats path traversal

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...

CVE-2026-19270

Hulupeep mcp-ui-probe up to 0.2.0 contains a local path-traversal vulnerability in Journey/Usage’s JourneyStorage.ts. The affected functions—get_journey, delete_journey, analyze_journey, and usage_stats—manipulate journeyId/filename to access unintended paths. The issue requires local access; no ...

EUVD-2026-54769

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...

CVE-2026-19259

The CVE concerns MZ Automation libiec61850 (up to 1.6.1). The vulnerability is in the MMS Protocol Workflow, specifically MmsMapping_varAccessSpecToObjectReference in src/iec61850/common/iec61850_common.c, where manipulation of GetNamedVariableListAttributesResponse.itemId causes a heap-based buf...

EulerOS 2.0 SP11 : python-pygments (EulerOS-SA-2026-3150)

According to the versions of the python-pygments packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file...

CVE-2026-19206

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

EUVD-2026-54368

A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed ...

EUVD-2026-54260

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mmsmapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be...

EUVD-2026-54272

Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...

CVE-2026-19059

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...

CVE-2026-19047

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...

CVE-2026-19047 NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...

CVE-2026-19044

CVE-2026-19044 affects LeeSinLiang godot-mcp 0.1.0. The vulnerability is in the function executeOperation of src/index.ts within the create_scene/add_node component, where manipulation of the argument projectPath allows command injection. Exploitation requires local access. The report notes the i...

CVE-2026-19039 Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...

EUVD-2026-53877

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...

CVE-2026-71227 Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

CVE-2026-18852 epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition

A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.cpp of the component Filter Parser. Such manipulation leads to improper check for unusual condition...