Exposed Dangerous Method or Function

Overview @penpot/mcp is a MCP server for Penpot integration Affected versions of this package are vulnerable to Exposed Dangerous Method or Function via MCP module's ReplServer that binds to all interfaces 0.0.0.0:4403 and exposes a /execute endpoint that runs arbitrary code with zero...

GHSA-JXXR-4GWJ-5JF2

creationtimestamp| type| source ---|---|--- 2026-05-19 19:42:10+00:00| seen| https://gist.github.com/konard/d8a22725a8b00a188eb2098b18eaa766 2026-05-19 19:44:33+00:00| seen| https://gist.github.com/konard/beb604d0f86e740a59c10cc19fb9b50b 2026-05-19 20:19:30+00:00| seen|...

EUVD-2026-30978

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow write vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by craftin...

Missing Authentication for Critical Function

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to exposing two unauthenticated API endpoints that, when chained together, allow any network-adjacent attacker to execute...

DEBIAN-CVE-2026-33637

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...

ALPINE-CVE-2026-32738

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samplesperchunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor mlastsample = 0 + 0 - 1 = UINT32MAX, mapping all samples to an empty...

CVE-2026-36829

creationtimestamp| type| source ---|---|--- 2026-05-19 19:02:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mma3cp2l3s2k 2026-05-19 19:02:24+00:00| seen| https://bsky.app/profile/potato.software/post/3mma3cpz45z25 2026-05-19 21:02:48+00:00| seen|...

CVE-2026-33633

creationtimestamp| type| source ---|---|--- 2026-05-19 19:02:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mma3chpmjk2w 2026-05-19 19:47:22+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mma5tcue5g2c 2026-05-19 20:18:07+00:00| seen|...

[SECURITY] Fedora 42 Update: kernel-6.19.14-106.fc42

The kernel meta package...

CVE-2026-47782

creationtimestamp| type| source ---|---|--- 2026-05-19 18:20:00+00:00| seen| https://jvn.jp/en/vu/JVNVU93461473 2026-05-21 02:41:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdfgatcka2q 2026-06-20 13:27:31+00:00| seen|...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

CVE-2026-33637 Faraday: Protocol-relative URI objects still bypass host scoping (possible incomplete fix for GHSA-33mh-2634-fwr2)

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request target is passed as a URI object rather than a String to Faraday::Connectionbuildexclusiveurl. This...

CLSA-2026-1779212122 sos: Fix of CVE-2022-2806

CVE-2022-2806: ovirt plugin: filter out all password keys in answer files...

WordPress Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Image Deletion vulnerability discovered by Bao Luu Gia Nguyen in WordPress Plugin NextGEN Gallery versions = 4.2.0...

SUSE-SU-2026:21743-1 Security update for kernel-livepatch-MICRO-6-0_Update_22

This update for kernel-livepatch-MICRO-6-0Update22 fixes the following issues: - New livepatch SLE Micro 6.0/6.1 kernel update 22...

EUVD-2026-30039

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion...

GHSA-FHVH-VW7H-9XF3 libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case

The AVX2 implementation of ML-DSA verification incorrectly implemented the usehint function, mishandling an edge case that should lead to signature rejection. Impact An attacker could make the ML-DSA verifier accept a crafted invalid signature under a maliciously generated verification key, if th...

libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.32 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.14.32 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.14.32 security, enhancement & bug fix update FIXED BUGS: ========== CVEs: ========== CVE-2025-52881...

Allocation of Resources Without Limits or Throttling

Overview Scriban.Signed is a fast, powerful, safe and lightweight scripting language and engine for .NET, which was primarily developed for text templating with a compatibility mode for parsing liquid templates. Affected versions of this package are vulnerable to Allocation of Resources Without...