EUVD-2026-55033

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

CVE-2026-13133: Uncontrolled Search Path Element

A vulnerability has been identified in LineInst.exe LINE for Windows prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path, allowing a malicious DLL placed in the installer's directory to be loaded ahead of the legitimate System32 copy...

PT-2026-76470

Summary The built-in knowledge search tools let a chat participant choose the pattern used to grep knowledge files. Patterns containing regex metacharacters were compiled with Python's backtracking re engine and run against every line of every reachable file, with no time limit anywhere on that...

PT-2026-76486

Summary With the Playwright web loader enabled, Open WebUI opens user-submitted URLs in a real browser and validates the destination address before allowing the request. That check only ran for the top-level page request. Every other request the page issued was passed through unvalidated, so a pa...

metabigor v2.2.0

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

yeti v2.6.1

Yeti Platform Yeti aims to bridge the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline for DFIR teams. It was born out of frustration of having to answer the question "where have I seen this artifact before?" or "how do I search for IOCs related t...

CVE-2026-19337

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-19337

CVE-2026-19337 affects the package adenot mcp-google-search up to version 0.3.1. The vulnerability is in an unknown function within src/index.ts of the component read_webpage , enabling server-side request forgery (SSRF) through manipulation of the url argument. The attack is described as restric...

CVE-2026-19337

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337 adenot mcp-google-search read_webpage index.ts server-side request forgery

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337 adenot mcp-google-search read_webpage index.ts server-side request forgery

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337: Server-Side Request Forgery (SSRF)

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

PT-2026-69278

Name of the Vulnerable Software and Affected Versions adenot mcp-google-search versions prior to 0.3.2 Description A server-side request forgery SSRF issue exists within the read webpage component in the src/index.ts file. This occurs when the url argument is manipulated, allowing for local...

PT-2026-69276

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description An issue exists where the software fails to properly sanitize and escape the field search parameter before incorporating it into a SQL statement. This allows unauthenticated users to perform...

K000162806: PostgreSQL vulnerability CVE-2026-6472

Security Advisory Description Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choic...

EUVD-2026-54649

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...

EUVD-2026-54648

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...