CVE-2026-19331: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-10595: Relative Path Traversal

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...

CVE-2026-19323: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b478d678b0. Affected by this vulnerability is the function generateProjectDocs of the file src/index.ts of the component analyze-projec. The manipulation of the argument projectName results in path...

SUSE SLES15: libpython3_10-1_0 / python310 / python310-base / python310-curses / etc (SUSE-SU-2026:3530-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3530-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when t...

PT-2026-69260

Name of the Vulnerable Software and Affected Versions Pimzino spec-workflow-mcp versions prior to 2.2.7 Description A path traversal issue exists in the ApprovalStorage.createApproval function within the src/tools/approvals.ts file. This occurs when the categoryName argument is manipulated,...

PT-2026-69315

Name of the Vulnerable Software and Affected Versions Nikolaibibo claude-comfyui-mcp version 1.0.0 Description A path traversal issue exists in the comfy upload image component within the src/tools/utils.ts file. The copyFileSync function does not properly validate the image path argument, allowi...

PT-2026-69310

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25 Description A path traversal flaw exists within the insert creds range config component, specifically in the src/tools/insertCredsRangeConfig.ts file. A local attacker can manipulate the configPa...

PT-2026-69317

Name of the Vulnerable Software and Affected Versions Handwriting-OCR handwriting-ocr-mcp-server version 0.1.0 Description A path traversal flaw exists in the upload document component within the src/index.ts file. The issue occurs in the fs.readFileSync function when the File argument is...

PT-2026-69250

Name of the Vulnerable Software and Affected Versions abracadabra50 claude-sesh version 1.0.0 Description A flaw in the enrichSession function within getEnrichedData located in the src/services/enricher.ts file allows for path traversal. This occurs when the sessionId argument is manipulated. Pat...

PT-2026-69253

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 3 Description A path traversal issue exists in the SPA catch-all route implemented in backend/routers/ui.py. The flaw occurs because user-controlled path input is joined into a filesystem path without proper...

PT-2026-69251

Name of the Vulnerable Software and Affected Versions aktsmm skill-ninja-mcp-server version 0.1.0 Description Local manipulation of the workspacePath argument in the getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill functions within the src/installer.ts file allows for path...

PT-2026-69259

Name of the Vulnerable Software and Affected Versions Jane-xiaoer skill-vision-control versions prior to 1.3.1 Description A path traversal issue exists in the getSkillVersionsDir function within the src/svc/utils/config.ts file. This occurs when the skillName argument is manipulated, allowing an...

PT-2026-69240

Name of the Vulnerable Software and Affected Versions azer react-analyzer-mcp versions up to 335f2a3585f265e2e88352b59b10d3b478d678b0 Description A path traversal flaw exists in the analyze-projec component within the generateProjectDocs function located in the src/index.ts file. This issue occur...

PT-2026-69279

Name of the Vulnerable Software and Affected Versions automateyournetwork MCPyATS versions prior to 0.1.5 Description A path traversal issue exists in the generate mermaid markdown component within the processGenerateRequest function located in the mcp servers/mermaid/index.ts file. A local...

PT-2026-69255

Name of the Vulnerable Software and Affected Versions bazylhorsey obsidian-mcp-server version 1.0.0 Description A path traversal issue exists in the readCanvas and writeCanvas functions within the src/services/CanvasService.ts file. This flaw allows a local attacker to access or modify files...

PT-2026-69312

Name of the Vulnerable Software and Affected Versions PV-Bhat gemsuite-mcp version 1.0.0 Description A path traversal issue exists within the gemini search/gemini reason/gemini process/gemini analyze component, specifically in the src/handlers/unified-gemini.ts file. A local attacker can exploit...

CVE-2026-19288

A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...

CVE-2026-19287

A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Affected by this issue is some unknown functionality of the component HistoryService. This manipulation of the argument ID causes path traversal. The attack needs to be launched locally. The project was informed of the problem early through...

CVE-2026-19288 astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal

A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...

CVE-2026-19288 astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal

A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...