83219 matches found
USN-8886-1: Linux kernel (NVIDIA Tegra) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - NVDIMM Non-Volatile Memory Device drivers; - Handshake API; - ARM32 architecture; - ARM64 architecture; - MIPS...
EUVD-2026-93469
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...
CVE-2026-105795
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...
CVE-2026-105798
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...
CVE-2026-25197
CVE-2026-25197: تجاوز التفويض عبر مفتاح يتحكم به المستخدم IDOR استشارة الحقل| القيمة ---|--- CVE| CVE-2026-25197 ICSA| ICSA-26-055-03 التحديث أ CVSS 3.1| 9.1 حرج المتجه| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-639 تجاوز التفويض عبر مفتاح يتحكم به المستخدم الباحث| Michael Groberman —...
DevHub-HTB-Walkthrough
DevHub – دليل HTB لينكس متوسط الجهاز: DevHub الصعوبة: Medium نظام التشغيل: Linux المواضيع: CVE-2026-23744, Chisel Tunneling, Jupyter, Flask API, تصعيد صلاحيات الجذر 📌 1. الاستطلاع nmap -sC -sV devhub.htb النتيجة: المنفذ 22 SSH المنفذ 80 HTTP المنفذ 6274 MCPJam Inspector 📌 2. تعديل ملف المضيفين ec...
mks-copy-fail-mitigation
DaemonSets لتخفيف ثغرات Copy Fail DaemonSets لمعالجة ثغرات عائلة Copy Fail على جميع عُقد العمل worker nodes في مجموعات MKS. المحتويات CVE-2026-31431 Copy Fail CVE-2026-43284, CVE-2026-43500, CopyFail2 Dirty Flag CVE-2026-31431 Copy Fail وصف الثغرة معرف CVE: CVE-2026-31431 رابط CVE:...
EUVD-2026-93426
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...
CVE-2026-105797 SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...
CVE-2026-105797
In SimpleChat versions 0.261.003 and 0.261.027 , an authorization ordering flaw in POST /api/user/plugins enables an authenticated low-privileged user to bypass security checks. By omitting the top-level MCP type , the _reject_non_admin_mcp_stdio inspection is skipped before the type is restored ...
CVE-2026-105797 SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...
CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...
CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...
EUVD-2026-93424
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...
CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...
wp2shell-vulnerability-scanner
ماسح WP2Shell أداة تدقيق أمني للقراءة فقط، غير تخريبية، تقوم بمسح تثبيتات ووردبريس بحثًا عن سلسلة الثغرات wp2shell. نظرة عامة ماسح WP2Shell هو أداة سطر أوامر بلغة bash تقوم بالبحث بشكل متكرر في شجرة الدلائل عن تثبيتات ووردبريس وتتحقق مما إذا كان كل موقع يشغل إصدارًا أساسيًا معرضًا لثغرات wp2shell...
CVE-2026-105790 Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...
EUVD-2026-93407
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...
CVE-2026-106037
Versions of Mooncake through 0.3.13.post1 are affected by a missing authentication vulnerability in the Store REST service . The service binds to 0.0.0.0 without requiring authentication on any route. This allows unauthenticated attackers to access specific endpoints, including /api/get , /api/pu...
PENTEST-LAB
PENTEST-LAB A modern vulnerable application & cyber range for learning web, API, cloud, AI, and blue-team security through hands-on attack chains. ╔═══════════════════════════════════════════════════════════════╗ ║ ██████╗ ███████╗███╗ ██╗████████╗███████╗███████╗████████╗ ║ ║ ██╔══██╗██╔════╝███...