9369 matches found
CVE-2025-62233: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version = 3.2.0 and 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class...
CVE-2026-26210
KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balanceserve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages using pickle.loads without validation. Attackers can...
CVE-2026-6942
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...
Exploit for CVE-2026-34159
CVE-2026-34159 0 Click RCE exploit for CVE-20...
CVE-2026-6942 radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2cmdstr. Attackers can inject shell metacharacters throu...
n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
Impact When n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust...
GHSA-PFM2-2MHG-8WPX n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
Impact When n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their request metadata written to server logs regardless of the authentication outcome. In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust...
PT-2026-34682
Name of the Vulnerable Software and Affected Versions n8n-mcp versions prior to 2.47.11 Description When running in HTTP transport mode, incoming requests to the 'POST /mcp' endpoint have their request metadata written to server logs regardless of whether authentication is successful. This can le...
bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +66 more potentially affected by CVE-2026-41681 via openssl (>=0.10.40, <=0.10.68)
openssl CARGO version =0.10.40, =0.5.0, =0.2.0, =0.0.1, =0.1.0-alpha.0, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.1.3, =0.1.10 and more Source cves: CVE-2026-41681 Source advisory: OSV:GHSA-GHM9-CR32-G9QJ...
USN-8197-1: Slurm vulnerability
It was discovered that Slurm did not properly handle access control when dealing with RPC traffic through PMI2 and PMIx, which could allow an unprivileged user to send data to an arbitrary unix socket on the host. An attacker could possibly use this issue to execute arbitrary code as the root use...
Exploit for Improper Input Validation in Microsoft
🚨 CVE-2026-33826: Windows Active Directory Remote Code Executi...
Monero: `set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM
The setdaemon JSON-RPC in monero-wallet-rpc was found to have a vulnerability that silently ignored the sslallowedfingerprints parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013278)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013278 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Don't leak netobj memory when gssreadproxyverf fails Tenable has extracted the preceding...
Monero: sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset
The vulnerability in monero-wallet-rpc's signmultisig function allowed a malformed but decryptable multisig transaction set to cause a process crash instead of returning an error. The issue was resolved in version 0.18.5.0...
Monero: Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks
The restricted ZMQ RPC in monerod did not enforce the same request restrictions as the restricted HTTP RPC. The ZMQ RPC relied primarily on a small method blocklist, allowing several allowed methods to accept requests that the restricted HTTP RPC explicitly rejected or capped. This issue was...
PT-2026-35589
A vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of...
PT-2026-37131
A vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of...
[SECURITY] Fedora 44 Update: kf6-kpeople-6.25.0-1.fc44
KDE Frameworks 6 Tier 3 library for interaction with XML RPC services...
SUSE SLED15: libnfsidmap0 / libnfsidmap1 / nfs-client / nfs-doc / etc (SUSE-SU-2026:1356-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1356-1 advisory. This update for nfs-utils fixes the following issue: Security fixes: - CVE-2025-12801: rpc.mountd allows ...
