Joomla! Component Arcade Games 1.0 - Local File Inclusion

A directory traversal vulnerability in the Arcade Games comarcadegames component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1714 info: name: Joomla! Component Arcade Games 1.0 - Local File Inclusion autho...

CVE-2026-67357 ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

Joomla! Component Arcade Games 1.0 - Local File Inclusion Detection

A directory traversal vulnerability in the Arcade Games comarcadegames component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the Arcad...

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

SummaryThe arcade-mcp HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This gran...

arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: OSV:PYSEC-2026-1192...

EUVD-2018-21751

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249 MyBB My Arcade Plugin 1.3 Persistent XSS via Comment

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249

CVE-2018-25249 concerns the MyBB My Arcade Plugin 1.3, which contains a persistent cross-site scripting (XSS) vulnerability in the arcade game score comments. The issue allows authenticated users to inject HTML/JavaScript payloads in the comment field, which execute when other users view or edit ...

CVE-2018-25249

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249 MyBB My Arcade Plugin 1.3 Persistent XSS via Comment

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

MyBB My Arcade Plugin Cross-site Scripting Vulnerability

The MyBB My Arcade Plugin is a forum download plugin developed by MyBB Corporation. Version 1.3 of the MyBB My Arcade Plugin contains a cross-site scripting vulnerability. This vulnerability arises from improper cleaning of input data in the arcade game score comment field, which may allow...

PT-2026-30369

Name of the Vulnerable Software and Affected Versions MyBB My Arcade Plugin version 1.3 Description Authenticated users can perform a persistent cross-site scripting attack by injecting malicious HTML and JavaScript payloads into the comment field of arcade game scores. These scripts execute...

CVE-2018-25249: Improper Neutralization of Input During Web Page Generation

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

agentstack-cli (>=0.5.0rc4, <=0.6.2), aieng-platform-onboard (>=0.5.0, <=0.6.1) +34 more potentially affected by CVE-2026-28802 via authlib (>=1.6.5, <=1.6.6)

authlib PYPI version =1.6.5, =0.5.0rc4, =0.5.0, =0.21.0, =0.44.0, =1.7.0, =0.8.0, =1.0.20, =0.12.0, =1.0.3, =0.2.0, =1.0.0, =1.115.2, =0.2.20, =1.0.0, =26.0.0, =26.0.2 and more Source cves: CVE-2026-28802 Source advisory: GHSA-7WC2-QXGW-G8GG...

From arcades to Azure: Felix’s security research journey

When you talk with Felix, you quickly get the sense that he has always been propelled by curiosity and by a need for something that truly challenges him. Today, he is a successful independent security researcher who uncovers vulnerabilities across Microsoft cloud services. However, his path into...

CVE-2025-66454

Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 : MAME vulnerabilities (USN-7913-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.04 / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7913-1 advisory. It was discovered that the stb library, included in MAME, had a heap-based buffer overflow. An attack...

arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: SNYK:PYTHON-ARCADEMCPSERVER-14171924...