EUVD-2026-86396

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the getUrl process. An attacker can execute arbitrary JavaScript in the context of the affected site by injecting specially crafted input into the src attribute of an iframe, which is not properly sanitized...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

EUVD-2026-86930

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97724

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...

OESA-2026-4107 tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fixes: Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos ...

PT-2026-98861

Name of the Vulnerable Software and Affected Versions Espruino version 2v29 Description A NULL pointer dereference occurs in the jslGetRawString function within src/jslex.c. When provided with specially crafted raw or binary string input, the lexer may pass a NULL iterator target to the...

CVE-2026-97228: Improper Neutralization of Special Elements in Data Query Logic

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

EUVD-2026-87108

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

CVE-2026-88389

Espruino 2v29 commit bffc6d0 contains a NULL pointer dereference vulnerability in jslGetRawString in src/jslex.c. Crafted raw/binary string input can cause the lexer to pass a NULL iterator target to jsvLockAgain. In RELEASE/NOASSERT builds, the missing assertion guard allows a write through the...

PT-2026-98461

Name of the Vulnerable Software and Affected Versions Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 Description A GraphQL query injection issue exists in the export-status component within the get export status function in src/export manager.py. The export id variable, which is an unvalidat...

PT-2026-98784

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the VXLAN Multicast Group Management MDB implementation. The function vxlan mdb is valid source incorrectly accepts all-zeros addresses for MDBE ATTR...

PT-2026-99095

Name of the Vulnerable Software and Affected Versions krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists within the Upload Functionality component. The flaw is located in the ConfigurationForm::rules function of the...

PT-2026-98764

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 multicast implementation where the ip6 mc del1 src function improperly handles the removal of source filters. When a filter count reaches zero, the function...

openSUSE 16 Security Update : python-PyMuPDF (openSUSE-SU-2026:21912-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21912-1 advisory. Changes in python-PyMuPDF: - CVE-2026-82035: a path traversal vulnerability in the font branch of extractobjects in src/main.py bsc1280486 Tenable has...

CVE-2026-97365

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly...

GHSA-FM8P-53WW-HF6W DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Summary DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080. The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then...

CyberChef: Prototype pollution in Series Chart operation

On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation. Other operations following Series Chart could hav...

CVE-2026-57440

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled not the default, the urls for videos are passed into an iframe...