CVE-2026-93954 grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

CVE-2026-50369

CVE-2026-50369 reproducer for a TOCTOU race condition in rdpcorets.dll!CRdpPipeGfxPlugin::Enable on Windows Server 2025 RDS Session Hosts. i reported this as a DoS; the code-path seem to somehow also enable EoP. this reproducer is a PoC for the DoS path alone. Bug Enable reads a COM interface...

CVE-2026-84445 affecting package azurelinux-image-tools for versions less than 1.6.0-3

CVE-2026-84445 affecting package azurelinux-image-tools for versions less than 1.6.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3

CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3. An upgraded version of the package is available that resolves this issue...

SUSE CVE-2026-46519

mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables ALLOWONLYREADONLYTOOLS, ALLOWONLYNONDESTRUCTIVETOOLS, ALLOWEDTOOLS documented as access controls for restricting which...

CVE-2026-93954: Incorrect Authorization

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

PT-2026-95870

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier Description An authorization bypass exists in the Download Endpoint component. A remote attacker can manipulate the bookId argument within th...

CVE-2026-93955: Authorization Bypass Through User-Controlled Key

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argumen...

PT-2026-95869

Name of the Vulnerable Software and Affected Versions grimmory-tools grimmory versions 3.3.3 and earlier grimmory-tools grimmory versions 3.4.1 and earlier Description An incorrect authorization issue exists in the Settings API Endpoint. A remote attacker can manipulate the...

Integrating AI Tools Into Research Teams: Productivity Benefits and Risks

AI tools are finding a place in research workflows, particularly for tasks such as transcription, summarization, and qualitative…...

GHSA-5GM3-9CRP-6G3V Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into...

EUVD-2026-83168

Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or...

Malicious Package

Overview linkedin-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Cisco Identity Services Engine (cisco-sa-ise-cmd-inj-e2CuZCYZ)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges toroot...

CVE-2026-80428

This repository does not have a README...

Important: Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.7 (CUDA)

Red Hat AI Inference Server Model Optimization Tools 3.3.7 CUDA is now available. Red Hat® AI Inference Server Model Optimization Tools...

CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

@bymbly/api-tools (>=1.3.1, <=1.4.55), @fsco/autosync (>=0.2.12, <=0.3.1) +1 more potentially affected by CVE-2026-63225 via @redocly/cli (>=2.0.2, <=2.32.2)

@redocly/cli NPM version =2.0.2, =1.3.1, =0.2.12, =2.5.0, =3.11.1 Source cves: CVE-2026-63225 Source advisory: OSV:GHSA-657C-G7QC-R9J2...

Lab-001-Gitea-CVE-2026-20896-

Lab-001-Gitea-CVE-2026-20896-...

A Bootiful Podcast: Spring Tools lead Martin Lippert

Hi, Spring fans! In this conversation, Spring Tools lead Martin Lippert joins us for a fascinating look at how developer tooling has evolved from Eclipse to VS Code and beyond. We dig into the architecture behind Spring Tools, language servers, MCP, and how the same ideas that once helped...