CVE-2026-15524 alioshr memory-bank-mcp list-project-files-validation-factory.ts path traversal

A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts. Such manipulation of the argument projectName leads to path traversal. Local access is required to approach this attack. The...

CVE-2026-15524

The vulnerability CVE-2026-15524 affects alioshr memory-bank-mcp up to versions 0.2.1/3.1. The issue resides in the file list-project-files-validation-factory.ts where manipulation of the projectName argument enables path traversal. Local access is required to exploit, and public disclosure of th...

BIT-GITLAB-2026-7492 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an unauthenticated user to determine the existence of a private project due to improper authorization controls...

PT-2026-59225

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create project/encrypt auth settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth...

PT-2026-59083

Description Bugsink’s issue list supports bulk actions such as resolving or muting selected issues. In affected versions, the issue list view authorizes access through the project in the URL, but applies the requested bulk action to the submitted issue IDs without also requiring those issues to...

Malicious code in slds-lsp-client (npm)

The slds-lsp-client package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Salesforce SLD...

CVE-2026-15524: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in alioshr memory-bank-mcp up to 0.2.1/3.1. This affects an unknown part of the file list-project-files-validation-factory.ts. Such manipulation of the argument projectName leads to path traversal. Local access is required to approach this attack. The...

PT-2026-57613

Name of the Vulnerable Software and Affected Versions augmnt augments-mcp-server version 7.1.0 Description A path traversal flaw exists in the scanProjectDeps function within the src/tools/v4/scan-project-deps.ts file of the scan project deps component. This issue occurs when the packageJsonPath...

ALSA-2026:38796 Important: plexus-utils security update

The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an...

GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework

Time Division Duplex TDD mobile networks require synchronization accuracy of $\pm$1.5 $μ$s 3GPP TS 38.104, with GNSS-disciplined grandmaster clocks as the predominant timing source. GNSS spoofing -- now a documented operational threat -- can corrupt timing across all downstream base stations, yet...

PT-2026-58979

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target...

PT-2026-59492

In OpenStack Cyborg before 16.0.1, the Accelerator Request ARQ API does not enforce project ownership at any layer. The project id column in the database is never populated NULL for every ARQ, database queries have no project filtering, and policy checks are self-referential the authorize wsgi...

PT-2026-59499

Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the...

PT-2026-59084

Description Bugsink issue event pages accept a direct event identifier from the URL and, in affected versions, look up that event without also requiring it to belong to the issue in the URL. This is a project-boundary authorization issue: a logged-in user with access to one project can view anoth...

PT-2026-59168

Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...

PT-2026-60087

Summary The Timesheet API PATCH /api/timesheets/id and POST /api/timesheets endpoints accept a user-supplied project ID and resolve it through a Symfony EntityType whose query builder allows the submitted ID to satisfy the access predicate via an unconditional OR branch. As a result, any...

PT-2026-59293

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function evaluateCode of the file metagpt/environment/minecraft/mineflayer/index.js of the component Mineflayer HTTP API. Executing a manipulation can lead to cross-site request forgery. The attack...

PT-2026-57611

Name of the Vulnerable Software and Affected Versions alioshr memory-bank-mcp versions 0.2.1 through 3.1 Description A path traversal issue exists within the list-project-files-validation-factory.ts file. This occurs when the projectName argument is manipulated, allowing an attacker with local...

Project-SMARTPRO PlatformHandler.axd Path Traversal

The vulnerability in the PlatformHandler.axd handler of the automated information system “Web-Torgi KS” and the software package “Budget-NEXT” is related to improper validation of the path name for the directory. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized...

PT-2026-59500

Summary PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins...