CVE-2026-15529 yzhao062 pyod persistence.py pyod.utils.persistence.load deserialization

A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persistence.load of the file pyod/utils/persistence.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. Upgrading to version 3.6.2 is abl...

CVE-2026-15528

CVE-2026-15528 affects lamaalrajih/kicad-mcp up to 3.3.1. The vulnerability is in kicad_mcp/utils/path_validator.py where manipulating the arguments project_path or schematic_path causes a protection mechanism failure. Local exploitation is required, and the exploit has been made public. The proj...

EUVD-2026-43273

A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicadmcp/utils/pathvalidator.py. Performing a manipulation of the argument projectpath/schematicpath results in protection mechanism failure. Attacking locally is a requirement...

CVE-2026-15526

A vulnerability in augmnt augments-mcp-server 7.1.0 affects the function scanProjectDeps (src/tools/v4/scan-project-deps.ts) of the scan_project_deps component. The issue arises from manipulating the argument packageJsonPath, enabling path traversal. The attack is local, and a proof-of-concept/ex...

CVE-2026-15522 tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

CVE-2026-15521

The CVE applies to makafeli n8n-workflow-builder up to 0.11.0. Vulnerable is an unknown function in build/server.cjs (update_node_from_file); manipulating the filePath argument enables path traversal. Local attack required; exploit publicly available. Project was informed via issue report but has...

CVE-2026-15515 Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path

A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is...

PT-2026-59016

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function process audio block of the file src/agentscope/agent/ agent base.py. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the...

PT-2026-60069

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An issue exists in the download your data flow where the resulting Active Storage blob redirect URL can be replayed without...

The vulnerability of the gnutls_pkcs12_bag_set_data() function in the GnuTLS cryptographic library allows a attacker to damage memory or cause service failures.

The vulnerability of the gnutlspkcs12bagsetdata function in the GnuTLS cryptographic library is related to a single-precision shift error. Exploiting this vulnerability could allow an attacker to corrupt memory or cause service failures...

The vulnerability of the function nameconstraints_node_list_intersect() in the lib/x509/name_constraints.c file, lines 726-727, of the cryptographic library GnuTLS, allows a attacker to perform a MIT attack.

The vulnerability of the nameconstraintsnodelistintersect function in the lib/x509/nameconstraints.c file, lines 726-727, of the cryptographic library GnuTLS is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to perform a MITM attack...

ROS-20260713-73-0003

The vulnerability of the Go programming language is related to improper validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain increased privileges...

ROS-20260713-73-0002

The vulnerability in Portainer-Ce is related to the incorrect implementation of the authentication algorithm. Exploiting this vulnerability allows an attacker who operates remotely to bypass security restrictions and gain unauthorized access to protected information...

Decidim - Admin user search allows SQL injection through similarity-based sorting

Description The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression. Impact - Exploitation require...

PT-2026-60112

Name of the Vulnerable Software and Affected Versions DIRAC versions prior to 8.0.79 DIRAC versions prior to 9.0.22 DIRAC versions prior to 9.1.10 Description The initial wrapper script downloads the second stage pilot pilot.tar and executes the contained script without verifying the web server's...

PT-2026-59499

Summary PDM writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets. This creates an arbitrary file clobber primitive relative to the privileges of the...

PT-2026-57647

A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch...

Malicious code in salesforce-vscode-slds (npm)

The salesforce-vscode-slds package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a...

CVE-2026-51537

EIPStackGroup OpENer 2.3.0 commit 76b95cf has an out-of-bounds read issue in Connection Manager handling of ForwardOpen requests when processing short malformed packets. An attacker can send a valid ENIP outer frame carrying a malformed CIP ForwardOpen/LargeForwardOpen request, causing the parser...

CVE-2026-51538

EIPStackGroup OpENer 2.3.0 commit 76b95cf suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided sessionhandle exists in the global session list, but it fails to...