20611 matches found
CVE-2026-6108 1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection
A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1. The affected element is the function execute of the file apps/application/flow/stepnode/mcpnode/impl/basemcpnode.py of the component Model Context Protocol Node. Performing a manipulation results in os command injection. The attack is...
Machine Learning-Based Detection of MCP Attacks
The Model Context Protocol MCP is a new and emerging technology that extends the functionality of large language models, improving workflows but also exposing users to a new attack surface. Several studies have highlighted related security flaws, but MCP attack detection remains underexplored. To...
MaxKB Operating System Command Injection Vulnerability
MaxKB is an open-source question-answering system based on large language models and RAG, developed by 1Panel-dev. Versions of MaxKB 2.6.1 and earlier contained a vulnerability related to operating system command injection. This vulnerability originated from the execute function in the Model...
CVE-2026-6108: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in 1Panel-dev MaxKB up to 2.6.1. The affected element is the function execute of the file apps/application/flow/stepnode/mcpnode/impl/basemcpnode.py of the component Model Context Protocol Node. Performing a manipulation results in os command injection. The attack is...
CVE-2026-6130: Improper Neutralization of Special Elements used in an OS Command
A flaw has been found in chatboxai chatbox up to 1.20.0. This impacts the function StdioClientTransport of the file src/main/mcp/ipc-stdio-transport.ts of the component Model Context Protocol Server Management System. Executing a manipulation of the argument args/env can lead to os command...
Updated python-django packages fix security vulnerabilities
ASGI header spoofing via underscore/hyphen conflation. CVE-2026-3902 Privilege abuse in GenericInlineModelAdmin. CVE-2026-4277 Privilege abuse in ModelAdmin.listeditable. CVE-2026-4292 Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload. CVE-2026-33033...
MINI-VW95-488G-FX6W
Bulletin has no description...
MINI-5V2X-85QJ-RC4R
Bulletin has no description...
MINI-952J-G235-HV4C
Bulletin has no description...
MINI-659W-CVV4-WJCX
Bulletin has no description...
MINI-Q934-9RP9-WP77
Bulletin has no description...
MINI-Q436-34P9-X386
Bulletin has no description...
MINI-F773-HCGP-G7VM
Bulletin has no description...
MINI-9V5R-RJ28-35F6
Bulletin has no description...
MINI-25VQ-VC7H-Q6HC
Bulletin has no description...
MINI-X32R-659J-7V5X
Bulletin has no description...
Exploit for Improper Neutralization of Special Elements in Data Query Logic in Facturascripts
CVE-2026-25513: FacturaScripts has SQL Injection in API ORDER...
MINI-C28F-V35H-GJ79
Bulletin has no description...