CVE-2026-85620 Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

EUVD-2026-71227

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

CVE-2026-85620 Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

CVE-2026-74853

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853

The Pods WordPress plugin (versions before 3.3.9.2 ) is vulnerable to an arbitrary file read vulnerability. The root cause is that the plugin fails to restrict which functions a display callback can resolve to. This allows users with the author role or higher to read arbitrary files from the serv...

amavis v2.15.0

Installation Use your system's amavis package if possible. Prerequisites Software dependencies are tracked via Dist::Zilla. Some of them involve non-perl development libraries and GCC as a build dependency if obtained from CPAN: libdb libidn2 libssl libzmq3 On Debian 13 for example, one can insta...

PT-2026-91337

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fb set var in helper Handle fbcon during display updates in fb set var from user. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all...

CVE-2026-85704: Concurrent Execution using Shared Resource with Improper Synchronization

A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. This issue affects the function getJailbreak of the file server/config.py of the component Jailbreak Mode. The manipulation results in race condition. It is possible to launch the...

CVE-2026-80786: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers. On...

PT-2026-85627

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fbdev component where user-invoked calls to the fb set var function were not consistently handling fbcon during display updates. While the FBIOPUT VSCREENINFO ioct...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

PT-2026-85544

Name of the Vulnerable Software and Affected Versions Postgres MCP Pro version 0.3.0 Description A restricted-mode bypass exists where function-name validation is not applied to RangeFunction nodes within FROM clauses. This allows attackers to bypass the allowlist and execute file-reading...

CVE-2026-85661: Improper Limitation of a Pathname to a Restricted Directory

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

PT-2026-85554

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL FILES PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

PT-2026-86262

CVE-2026-85704: Race condition in Freegpt Webui Jailbreak Mode, server/config.py allows remote attacks, but high complexity makes exploitation difficult. CVSS 3.7. Public exploit exists. No patch available. Update or monitor POC available https://t.co/2oFcukN71V valtersit CVE CVEAlert infosec...

CVE-2026-85703: Allocation of Resources Without Limits or Throttling

A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be...

CVE-2026-85620: Incorrect Authorization

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

PT-2026-85626

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the fbdev component, the functions show mode, show modes, and store mode access fb info-modelist and fb info-mode without utilizing the lock fb info function. Because store modes...

Linux Distros Unpatched Vulnerability : CVE-2026-80786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: Wrap user-invoked calls to fbsetvar in helper Handle fbcon during display updates in fbsetvarfromuser. Check with fbcon if the mode change is possible,...

CVE-2026-18167

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...