4258 matches found
PT-2026-68412
Name of the Vulnerable Software and Affected Versions mf-yang openclaw-cn versions prior to 0.2.2 Description A remote attack is possible in the apply patch Tool component due to an issue in the assertNoSymlinkEscape function within the src/agents/sandbox-paths.ts file. This flaw allows for link...
PT-2026-68413
Name of the Vulnerable Software and Affected Versions TinyAGI version 0.0.20 Description A remote file inclusion issue exists within the Message API Endpoint component. The flaw is located in the collectFiles function within the packages/core/src/response.ts file, allowing an attacker to remotely...
CVE-2026-19040: Server-Side Request Forgery (SSRF)
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...
CVE-2026-18990: Missing Authentication for Critical Function
A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The...
CVE-2026-19006: Incorrect Authorization
A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...
PT-2026-68414
Name of the Vulnerable Software and Affected Versions TinyAGI version 0.0.20 Description A remote attack can be launched against the Message API Endpoint due to missing authorization. The issue resides in the processMessage function within the packages/main/src/index.ts file. Recommendations As a...
PT-2026-68501
Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25 Description Command injection is possible on the local host through the manipulation of the Description argument within the SecretDialog.showSecretDialog function, located in the...
CVE-2026-71267: Stack-based Buffer Overflow
microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...
PT-2026-68140
Name of the Vulnerable Software and Affected Versions microtar affected versions not specified Description The mtar write file header and mtar write dir header functions in src/microtar.c contain a stack buffer overflow. This occurs because a caller-supplied entry name is copied into the 100-byte...
PT-2026-68163
Name of the Vulnerable Software and Affected Versions Bolt CMS affected versions not specified Description Bolt CMS renders content field values using the full Twig application-level Environment without a SandboxExtension. In the src/Entity/Field.php file, the getTwigValue function calls...
CVE-2026-71215: Improper Limitation of a Pathname to a Restricted Directory
art-template's sub-template resolution logic src/compile/adapter/resolve-filename.js, used by both the include and extend template directives, resolves the target file path via path.resolveroot, filename with no check afterward that the result remains inside root...
CVE-2026-71291: Improper Neutralization of Special Elements Used in a Template Engine
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allowtwig flag and a regex...
CVE-2026-71202: Integer Underflow (Wrap or Wraparound)
The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...
PT-2026-68150
Name of the Vulnerable Software and Affected Versions rust-iot-platform affected versions not specified Description The AuthToken request-guard implementation in api/src/main.rs fails to validate the value of the Authorization HTTP header against a session, token store, or signature. It only...
CVE-2026-71277: Improper Authentication
rust-iot-platform's AuthToken request-guard implementation api/src/main.rs only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header e.g. satisfies th...
CVE-2026-71278: Improper Control of Generation of Code
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create api/src/controller/calcrulerouter.rs containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication...
CVE-2026-70374: Improper Neutralization of Special Elements used in an OS Command
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...
PT-2026-68155
Name of the Vulnerable Software and Affected Versions ChirpStack affected versions not specified Description An authenticated user with device-list access can perform SQL injection when the SQLite backend is used. The issue occurs because the user-supplied tag key is interpolated directly into a...
