GHSA-43R2-C7G8-PRC8 obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Impact Bridge tool results filtered only the items array against the read ACL and passed sibling fields through unfiltered: tasksfilter emitted groups whose counts reflected denied notes, makemdquery returned ...result siblings, and listtemplates enumerated Templater template paths and parsed...

CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File Read 🔥 Vulnerability Summary The Eventin plugin = 4.0.26 for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxyimage function. Attackers exploit insufficient input validation by manipulating the url...

Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2025-5278)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-5278 DESCRIPTION: A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access memory outside the...

CVE-2026-89974

A flaw was found in the Linux kernel's nvme-fc component, which handles Non-Volatile Memory Express over Fibre Channel. When a controller is being added and the nvmeaddctrl function fails, a specific error handling path does not correctly manage memory. This leads to the same memory region being...

CVE-2026-115754

A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct cross-site scripting XSS attacks by supplying crafted function source text containing unescaped script closing tags. When serialized into a web page, the malicious payload can prematurely close the enclosin...

CVE-2026-89990

A flaw was found in the Ceph filesystem module of the Linux kernel. A local attacker could trigger a use-after-free vulnerability in the cephmdscheckaccess function. This occurs when a concurrent session reopens and frees an array while it is still being accessed, leading to a system crash and...

mcp-gamehacking

mcp-gamehacking MCP Model Context Protocol server for game hacking & reverse engineering. A structured knowledge base of 4,100+ skills with full source code archives, specialized agents, and workflow tools -- designed to be plugged into Claude, Cursor, or any MCP-compatible client. MCP-server for...

cve-2024-48325

CVE-2024-48325 Description: An authenticated user can abuse SQL injection vulnerability exists in the getDocuments function of the InstituicaoDocumentacaoController class. The instituicaoid parameter in /module/Api/InstituicaoDocumentacao?oper=get&resource=getDocuments&instituicaoid is not proper...

CVE-2022-44318

Description of CVE-2022-44318 PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall. Any project or library that uses Picoc also suffers from this issue. An example of this would be...

CVE-2026-90033

A flaw was found in the Linux kernel's ALSA USB audio subsystem. The sndusbmidius122loutput function, responsible for handling USB MIDI output, incorrectly calculates the buffer size for devices operating at slower than high speed. This error can lead to an out-of-bounds write, where the system...

CVE-2026-85746

A flaw was found in MariaDB. An authenticated remote attacker with low privileges can cause memory corruption and potentially achieve arbitrary code execution by submitting specially crafted Geographic Information System GIS objects. This issue is caused by an out-of-bounds write in the STAsText...

SUSE CVE-2026-115348

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parselinktext function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '' or '!' characters, forcing...

SUSE CVE-2026-115349

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...

R_EXPLOIT

R-Exploit — Authorized Web Security Audit + Local Lab Open-...

CVE-2026-90046

A flaw was found in the Linux kernel. Specifically, within the mm/pagealloc component, an issue exists with the spintrylock function when used in Non-Maskable Interrupt NMI contexts on Uniprocessor UP systems. A local attacker, by utilizing BPF Berkeley Packet Filter programs, could exploit this...

CVE-2026-90047

A flaw was found in the Linux kernel's drm/xe component. The getflatccsoffset function, responsible for managing video memory VRAM, incorrectly calculates available memory. This error allows a portion of memory intended for graphics compression hardware to be allocated for other uses. Consequentl...

Security Bulletin: IBM MQ Appliance is affected by multiple vulnerabilities

Summary IBM MQ Appliance has addressed multiple vulnerabilities in version 10.0.0.6. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399...

CVE-2026-106764

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function...

CVE-2026-106765

An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function...

Security Bulletin: Vulnerability in prox-addr Node.js module

Summary Vulnerability in prox-addr Node.js module Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust...