Joomla! Component Arcade Games 1.0 - Local File Inclusion

A directory traversal vulnerability in the Arcade Games comarcadegames component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1714 info: name: Joomla! Component Arcade Games 1.0 - Local File Inclusion autho...

CVE-2026-67357 ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67341

ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict...

Joomla! Component Arcade Games 1.0 - Local File Inclusion Detection

A directory traversal vulnerability in the Arcade Games comarcadegames component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the Arcad...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +207 more potentially affected by CVE-2026-54058 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +207 more potentially affected by CVE-2026-59205 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +207 more potentially affected by CVE-2026-59197 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +207 more potentially affected by CVE-2026-55379 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

3deecelltracker (>=0.5.1a0, <=0.5.2a0), adversarial-attacks-white-black-box (0.1.7) +200 more potentially affected by CVE-2026-55379 via pillow (9.3.0)

pillow PYPI version 9.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3deecelltracker =0.5.1a0, =1.5.0rc1, =0.0.3, =22.11.2, =2.6.17, =0.1.0a0, =0.1.0, =0.0.1a1, =0.3.1rc5, =0.8.0, =22.43.1, =22.52.1 and more Source...

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

SummaryThe arcade-mcp HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This gran...

arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: OSV:PYSEC-2026-1192...

active-time-scheduling (>=1.0.0, <=1.0.2), aimfast (>=1.3.0, <=1.3.3) +178 more potentially affected by CVE-2026-54059 via pillow (9.2.0)

pillow PYPI version 9.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - active-time-scheduling =1.0.0, =1.3.0, =2.2.1, =22.7.6, =0.0.29, =20220819.1.0, =0.24.0, =0.5.0, =0.9.1, =0.18.0, =0.19.0 and more Source cves:...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +207 more potentially affected by CVE-2026-55380 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

3deecelltracker (>=0.5.1a0, <=0.5.2a0), adversarial-attacks-white-black-box (0.1.7) +200 more potentially affected by CVE-2026-55380 via pillow (9.3.0)

pillow PYPI version 9.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 3deecelltracker =0.5.1a0, =1.5.0rc1, =0.0.3, =22.11.2, =2.6.17, =0.1.0a0, =0.1.0, =0.0.1a1, =0.3.1rc5, =0.8.0, =22.43.1, =22.52.1 and more Source...

EUVD-2018-21751

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249 MyBB My Arcade Plugin 1.3 Persistent XSS via Comment

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249

CVE-2018-25249 concerns the MyBB My Arcade Plugin 1.3, which contains a persistent cross-site scripting (XSS) vulnerability in the arcade game score comments. The issue allows authenticated users to inject HTML/JavaScript payloads in the comment field, which execute when other users view or edit ...

CVE-2018-25249 MyBB My Arcade Plugin 1.3 Persistent XSS via Comment

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...

CVE-2018-25249

MyBB My Arcade Plugin 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through arcade game score comments. Attackers can add crafted HTML and JavaScript payloads in the comment field that execute when other users view or edit...