CVE-2025-68109

creationtimestamp| type| source ---|---|--- 2026-04-16 21:02:32+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mjncncgazj2p...

GHSA-353C-V8X9-V7C3 MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

Summary The readRequestBody function in src/transports/http/server.ts concatenates HTTP request body chunks into a string with no size limit, allowing a remote unauthenticated attacker to crash the server via memory exhaustion with a single large HTTP POST request. Details File:...

MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

Summary The readRequestBody function in src/transports/http/server.ts concatenates HTTP request body chunks into a string with no size limit, allowing a remote unauthenticated attacker to crash the server via memory exhaustion with a single large HTTP POST request. Details File:...

Allocation of Resources Without Limits or Throttling

Overview mcp-framework is a Framework for building Model Context Protocol MCP servers in Typescript Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the readRequestBody function. An attacker can exhaust system memory and cause a server...

CVE-2026-37338

creationtimestamp| type| source ---|---|--- 2026-04-16 20:44:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnbkprs2p2f...

CVE-2026-34018

creationtimestamp| type| source ---|---|--- 2026-04-16 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN78422311 2026-04-17 06:05:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjoaxsb5ce2s 2026-04-20 17:20:51+00:00| seen| Telegram/GfeUhnyJYShCjvs7rm1XQAQJnKqowYjnl2h2DVxLAV4-eNA...

CVE-2026-34161

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...

CVE-2025-36579

creationtimestamp| type| source ---|---|--- 2026-04-16 18:14:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmz6xedk72d...

CVE-2026-6409

creationtimestamp| type| source ---|---|--- 2026-04-16 17:21:05+00:00| published-proof-of-concept| Telegram/YKX-6KXVqHKUWR-VRt4uZwi-aDyDZ2w2e-w4Y4gyD3o3fyw 2026-04-16 18:23:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmzqy3ntc26...

CVE-2026-3324

creationtimestamp| type| source ---|---|--- 2026-04-16 17:08:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmvjyv6jw2q 2026-04-16 17:20:51+00:00| seen| Telegram/s117pb2GT3VwdfXaV13Oi8Gqr-ePRyI5oBJZVU7ek3MbpQ...

CVE-2026-31987

creationtimestamp| type| source ---|---|--- 2026-04-16 17:07:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjmvirpmir2y 2026-04-18 05:18:34+00:00| published-proof-of-concept| Telegram/veDSMFN7ecyhltWdKUwpcYAyE-ogEw-qfchv6YBZH7Zn1oc...

CVE-2025-49931

creationtimestamp| type| source ---|---|--- 2026-04-16 17:07:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjmvieto772e...

CVE-2026-37347

creationtimestamp| type| source ---|---|--- 2026-04-16 16:58:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmuy42mew2f 2026-04-17 08:15:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116419049012865228...

Building your cryptographic inventory: A customer strategy for cryptographic posture management

Post-quantum cryptography PQC is coming—and for most organizations, the hardest part won’t be choosing new algorithms. It will be finding where cryptography is used today across applications, infrastructure, devices, and services so teams can plan, prioritize, and modernize with confidence. At...

CVE-2026-25704

creationtimestamp| type| source ---|---|--- 2026-04-16 15:38:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjmqiazslq2r...

CVE-2024-8010

creationtimestamp| type| source ---|---|--- 2026-04-16 14:44:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmnidlf3e26...

CVE-2025-15621

creationtimestamp| type| source ---|---|--- 2026-04-16 14:29:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmmol6ohx2t 2026-04-17 13:00:15+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116420169665687709...

CVE-2026-6270

creationtimestamp| type| source ---|---|--- 2026-04-16 13:50:08+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mjmki3smik2n 2026-04-16 15:19:53+00:00| seen| Telegram/5D912vOHN-G66auq1Hho6wwp26h6YJ5ZFpozWyyt1z6weM...

CVE-2026-31843

creationtimestamp| type| source ---|---|--- 2026-04-16 13:22:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjmiwmrtvr2h 2026-04-16 14:48:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmnrbzaqd2f 2026-04-16 15:19:53+00:00| seen|...

CVE-2026-3155 OneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'

The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...