25070 matches found
EUVD-2026-21974
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the SW-URL header in the MCP server. An attacker can access internal resources and potentially exfiltrate sensitive information by sending crafted requests that are processed by the server. Remediati...
Malicious Package
Overview @kucoin-gbiz-next/tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
Malicious code in @kucoin-gbiz-next/tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74b28e2536b0d59d01e913269776e3bd933f0bce2477136d28b923d2b5222d54 The package @kucoin-gbiz-next/tools was found to contain malicious code. Source: ghsa-malware...
MAL-2026-2587 Malicious code in @kucoin-gbiz-next/tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74b28e2536b0d59d01e913269776e3bd933f0bce2477136d28b923d2b5222d54 The package @kucoin-gbiz-next/tools was found to contain malicious code. Source: ghsa-malware...
UBUNTU-CVE-2026-30998
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...
CVE-2026-6141
A vulnerability was determined in danielmiessler PersonalAIInfrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parseurl.ts. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclos...
CVE-2026-30998: Uncontrolled Resource Consumption
An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted input file...
RHEL 8 : go-toolset:rhel8 (RHSA-2026:7879)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7879 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: cmd/go: cmd/go:...
The Best Vulnerability Scanning Tools for 2026: A Complete Guide
Your vulnerability scanner found 14,000 issues last quarter. Your team patched 800. The other 13,200 are sitting in a spreadsheet that nobody opens anymore. This is the reality for most security teams. The scanner works. It finds vulnerabilities. But without context, prioritization, or a clear pa...
Machine Learning-Based Detection of MCP Attacks
The Model Context Protocol MCP is a new and emerging technology that extends the functionality of large language models, improving workflows but also exposing users to a new attack surface. Several studies have highlighted related security flaws, but MCP attack detection remains underexplored. To...
PT-2026-46806
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description An out of bounds read in DevTools allows a remote attacker to execute arbitrary code inside a sandbox when a user opens a crafted HTML page. An out of bounds read occurs when the system...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: chezmoi, licenseclassifier, kine, oras, rancher, mesosphere-vsphere-csi, kaf, aws-flb-firehose, sriov-network-device-plugin, redpanda, zot, spire-server, regclient, gitaly, prometheus-operator, crane, cert-manager, nerdctl, hubble, extism, step-ca, datadog-agent, hel...
GHSA-M4PR-4J3G-9V7V vulnerabilities
Vulnerabilities for packages: chezmoi, kine, docker-credential-ecr-login, kubernetes-csi-node-driver-registrar, oras, victoriametrics, whereabouts, rancher-webhook, gitaly, kubernetes-replicator, crane, chisel, hubble, k8sgpt-operator, pguser, runc, rancher-agent, git-sync, s5cmd,...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: chezmoi, mockgen, cfssl, docker-credential-ecr-login, kine, kubernetes-csi-node-driver-registrar, oras, protoc-gen-go-grpc, victoriametrics, whereabouts, rancher-webhook, gitaly, kubernetes-replicator, crane, chisel, hubble, k8sgpt-operator, pguser, runc,...
GHSA-GJVH-7JH8-7XHM vulnerabilities
Vulnerabilities for packages: chezmoi, kine, docker-credential-ecr-login, kubernetes-csi-node-driver-registrar, oras, victoriametrics, whereabouts, rancher-webhook, gitaly, kubernetes-replicator, crane, chisel, hubble, k8sgpt-operator, pguser, runc, rancher-agent, git-sync, s5cmd,...
CVE-2026-27140 vulnerabilities
Vulnerabilities for packages: commercial-chainloop-backend, crossplane-provider-aws-sns-fips, ceph-csi-operator, chezmoi, envoy-ratelimit-fips, hugo, ingress-nginx-controller-fips, terraform-provider-kubernetes-fips, kafkaexporter, coredns, prometheus-elasticsearch-exporter, stern, harbor,...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: sqlite: lemon-3.52.0-1.1.hum1 aarch64, x8664 sqlite-3.52.0-1.1.hum1 aarch64, x8664 sqlite-analyzer-3.52.0-1.1.hum1 aarch64, x8664 sqlite-debug-3.52.0-1.1.hum1 aarch64, x8664...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libtasn1: libtasn1-4.21.0-1.1.hum1 aarch64, x8664 libtasn1-devel-4.21.0-1.1.hum1 aarch64, x8664 libtasn1-tools-4.21.0-1.1.hum1 aarch64, x8664 libtasn1-4.21.0-1.1.hum1.src src...
GHSA-G985-WJH9-QXXC PraisonAI Vulnerable to RCE via Automatic tools.py Import
PraisonAI automatically imports ./tools.py from the current working directory when launching certain components. This includes call.py, toolresolver.py, and CLI tool-loading paths. A malicious tools.py placed in the process working directory is executed immediately, allowing arbitrary Python code...