197052 matches found
EUVD-2026-58529
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...
EUVD-2026-58550
A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack...
EUVD-2026-58487
A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level o...
CVE-2026-19758 dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal
A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...
CVE-2026-19757 Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal
CVE-2026-19757 affects Dromara lamp-cloud up to version 5.10.0, specifically the File-Upload Controller FileAnyoneController.java. The vulnerability arises from manipulation of the bucket/bizType argument, enabling path traversal. Exploitation is remote and an exploit has been made public. The de...
CVE-2026-19753
The CVE-2026-19753 entry concerns MCP Server’s MCP-rdf-explorer 1.0.0, specifically the explore_url function in src/mcp-rdf-explorer/server.py. A server-side request forgery (SSRF) vulnerability results from manipulating the url argument, with the attack described as potentially remotely initiabl...
CVE-2026-19752
CVE-2026-19752 affects EnzoVezzaro’s mcp-dominican-layer (PDF Parsing), specifically the parse-pdf function in src/index.ts. A manipulation of the pdfUrl argument enables remote server-side request forgery (SSRF); exploitation is public and can be used. Documents indicate vulnerability details an...
CVE-2026-56865
The CVE-2026-56865 issue affects the Go module sumdb/tlog mechanism, where a malicious GOPROXY could forge up to two sumdb tiles, bypass the GOSUMDB check, and persist attacker-controlled module content to a local Go module cache. The consequence is the risk of serving malicious module content th...
CVE-2026-19750
CVE-2026-19750 affects Tenda CH, CP, and TX3 devices running 21.x–27.x firmware where the SSH component contains a hard-coded password. The issue allows remote exploitation of an unknown SSH functionality, with the exploit publicly available. The CVSS assessments indicate high severity (up to 9.2...
Malicious code in react-shield (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 168d48206ed936b10520351701ff64b38511462bd75eb9c8724f7039dbc211e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2026-58472
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to...
CVE-2026-19749
CVE-2026-19749 affects Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C. The vulnerability involves an unknown RTSP/ONVIF functionality where manipulation results in missing authentication, allowing remote initiation. The issue is described as having high attack com...
CVE-2026-18509
CVE-2026-18509 affects IBM i 7.3–7.6 (5770-SS1). The vulnerability enables a local authenticated attacker to escalate privileges via the Navigator for i debugger, potentially allowing access to or manipulation of sensitive data or creation of elevated user profiles. Root cause aligns with imprope...
EUVD-2026-58469
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system...
EUVD-2026-58468
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...
EUVD-2026-58463
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion...
EUVD-2026-58462
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...
CVE-2026-17649
CVE-2026-17649 affects IBM i 7.3–7.6 via the NetServer component. A remote attacker could obtain sensitive information due to an out-of-bounds read. IBM lists affected releases and provides PTF fixes: 7.6 MJ10939, 7.5 MJ10938, 7.4 MJ10937, 7.3 MJ10936 (see IBM bulletin). Base score ~5.3 (CVSS3.1)...