CVE-2026-59809

SiYuan before v3.8.0 is affected by a secret exfiltration vulnerability in the http_request MCP tool . The tool interpolates secret placeholders into the destination URL parameter, meaning an MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send pla...

CVE-2026-33319

WWBN AVideo is an open source video platform. Prior to version 26.0, the uploadVideoToLinkedIn method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg. If an attacke...

Cross Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of error messages generated for the CMS login page, where the URL of the requested page is interpolated without proper escaping, allowing for arbitrary HTML injection...