CVE-2026-19333 NightTrek Supabase-MCP generate_types command injection

A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issue is some unknown functionality of the component generatetypes. The manipulation of the argument schema results in command injection. The...

Exploit for Code Injection in Protobufjs_Project Protobufjs

CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4...

EUVD-2026-54208

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

EUVD-2026-54174

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

CVE-2026-48088

OpenReception’s OpenReception appointment-booking software (prior to version 1.0.4) is vulnerable to unauthenticated crypto key provisioning via POST /api/tenants/{tenantId}/staff/{staffId}/crypto, allowing attacker-controlled ML-KEM-768 public keys to be registered for any tenant. The handler lo...

CVE-2026-3415

CVE-2026-3415 affects WSO2 products where the SchemaValidator Mediator processes XML input during validation. The XML parser may resolve external entities under certain crafted payloads, enabling an attacker with sufficient privileges to read files on the server and possibly cause outbound reques...

CVE-2026-3415 XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

CVE-2026-65432

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...

EUVD-2026-53856

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...

CVE-2026-67531

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531

CVE-2026-67531 affects FrontMCP before 1.5.7. The sandboxed codecall:execute tool could leak live host Zod schema instances to scripts via getTool, and due to Zod v4 _zod being non-configurable/non-writable, the ECMAScript Proxy invariant returned the raw host object. This allowed a script to rea...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

CVE-2026-71203

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-71203

CVE-2026-71203 affects changedetection.io. The Spec resource at /api/v1/full-spec allows unauthenticated access because its get() method lacks both the @auth.check_token and @validate_openapi_request decorators, bypassing API key protection that guards other /api/v1/* endpoints. This enables retr...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-71203 changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...