CVE-2026-19958: Improper Control of Generation of Code

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-19957: Server-Side Request Forgery (SSRF)

A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is...

PT-2026-73172

Name of the Vulnerable Software and Affected Versions graphlit graphlit-mcp-server version 1.0.1 Description A server-side request forgery SSRF issue exists in the ssrf-test Endpoint within the fetch function of the src/tools.ts file. This occurs when the url argument is manipulated, allowing a...

PT-2026-72729

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ASOC fsl audmix component where the functions fsl audmix put mix clk src and fsl audmix put out src convert user-provided enum items using snd soc enum item to val...

GO-2024-2456 vulnerabilities

Vulnerabilities for packages: scorecard, go-licenses, goreleaser, pulumi-kubernetes-operator, src-fingerprint, bom, gitness, gitsign, nuclei...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: osv-scanner, zot, pulumi-language-dotnet, flux-source-controller, pulumi, kubescape, grafana-alloy, kaniko, argo-workflows, trivy, grype, chezmoi, flux-kustomize-controller, timoni, wolfictl, k9s, gitsign, scorecard, pulumi-kubernetes-operator, bom, crossplane,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: osv-scanner, zot, pulumi-language-dotnet, flux-source-controller, pulumi, kubescape, grafana-alloy, kaniko, argo-workflows, trivy, grype, chezmoi, flux-kustomize-controller, timoni, wolfictl, k9s, gitsign, scorecard, pulumi-kubernetes-operator, bom, crossplane,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: osv-scanner, zot, pulumi-language-dotnet, flux-source-controller, trivy-operator, pulumi, kubescape, external-secrets-operator, rancher-fleet, grafana-alloy, kaniko, argo-workflows, trivy, witness, grype, gitaly, chezmoi, trufflehog, wolfictl, k9s, gitsign, scorecard...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, paranoia, addon-resizer, terraform-provider-acme, temporal-server, calico, rancher-fleet, grafana-alloy, temporal-ui-server, cluster-proportional-autoscaler, glab, dgraph, litestream, descheduler, dynamic-localpv-provisioner,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, terraform-provider-acme, glab, chezmoi, crossplane-provider-aws-rds, gh, opentelemetry-collector, fscrypt, fulcio, podman, traefik, scorecard, cloudflared, cloud-provider-aws, snyk-cli, syft, terraform-provider-tls, gitlab-runner,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, yunikorn-k8shim, paranoia, s5cmd, calico, gitness, influx, git-sync, temporal-ui-server, hey, doppler-kubernetes-operator, kubernetes-csi-external-attacher, litestream, descheduler, dynamic-localpv-provisioner, crossplane-provider-aws-rds, swagge...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, kind, grafana-alloy, kubernetes-csi-external-health-monitor, dgraph, mockgen, nova, swagger, ipfs-cluster, fulcio, docker-credential-gcr, envconsul, spark-operator, portieris, rabbitmq-cluster-operator, aws-application-networking-k8s, docker-cli,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: zot, crossplane-provider-azure-storage, terraform, k3s, flux-source-controller, pulumi, falcoctl, kubescape, timestamp-authority, crossplane-provider-azure, crossplane-provider-family-azure, flux-image-reflector-controller, buildkitd, glab, flux-kustomize-controller,...

CVE-2026-72832: Improper Neutralization of Input During Web Page Generation

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...

CVE-2026-73846: Insufficient Verification of Data Authenticity

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...

CVE-2026-73845: Improper Input Validation

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...

CVE-2026-73506

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

CVE-2026-19751: Server-Side Request Forgery (SSRF)

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-50544: Creation of Temporary File in Directory with Insecure Permissions

NortheBridge/luminalshine is a Sunshine-compatible game stream host for Moonlight. Prior to version 26.05.0-rc4, a latent gap exists on a default install, the file at src/platform/windows/misc.cpp lives at C:\ProgramData\LuminalShine\config\apps.json and is created by the SYSTEM service. Under...

CVE-2026-73506: Improper Neutralization of Escape, Meta, or Control Sequences

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...