CVE-2026-14699 zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink

A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the function assertPathAllowed of the file src/Markdownify.ts. Executing a manipulation can lead to symlink following. The attack can only be executed locally. The pull request to fix this issue awaits...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the XCF decoder when processing crafted image files. An attacker can cause a crash or read sensitive memory contents by supplying a specially crafted image file. Remediation A fix was pushed into the...

CVE-2026-10802 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attac...

EUVD-2026-33871

A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmmstatesecuritymode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack...

Unfixed XSS vulnerability at www.alfa.com.lb

Security researcher NoPh0BiA, has submitted on 22/10/2007 a cross-site-scripting XSS vulnerability affecting www.alfa.com.lb, which at the time of submission ranked 11119 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/10/2007. It is current...