Cisco Integrated Management Controller Argument Injection (CVE-2026-20200) (cisco-sa-cimc-arg-inject-upSHdMfU)

According to its self-reported version, Cisco Integrated Management Controller is affected by a vulnerability. - A command injection vulnerability exists in the web-based management interface of Cisco Integrated Management Controller IMC due to improper validation of user-supplied input. An...

The vulnerability in the Firefox web browser and Thunderbird email client relates to the issue of operations going beyond the buffer boundaries in memory, allowing attackers to trigger a service failure.

The vulnerability in the Firefox web browser and Thunderbird email client is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Vulnerability of the network driver for Windows Server operating systems, allowing a hacker to execute arbitrary code

The vulnerability of the Windows Server operating system’s network driver is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-66738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...

CVE-2026-19372

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19368 PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal

A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component geminisearch/geminireason/geminiprocess/geminianalyze. The manipulation of the argument filepath/filepaths results in path...

CVE-2026-19368

PV-Bhat gemsuite-mcp 1.0.0 contains a path traversal vulnerability in src/handlers/unified-gemini.ts (component chain gemini_search/gemini_reason/gemini_process/gemini_analyze). The issue arises from manipulation of the argument file_path/file_paths, which can be exploited from a local position. ...

EUVD-2026-54935

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

CVE-2026-19326 Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

EUVD-2026-54853

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

CVE-2026-19326

CVE-2026-19326 affects Jevon-Zhong Ai-doctor 0.0.1. The vulnerability is in the deleteImage function of ai-doctor-server/src/filemanagement/filemanagement.service.ts, where manipulating the imagePath argument enables path traversal. Local access is required. The project was informed via an issue ...

Linux Distros Unpatched Vulnerability : CVE-2026-19017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA...

PT-2026-69299

Name of the Vulnerable Software and Affected Versions 3CORESec Trapdoor versions prior to 1.2.3 Description Improper access controls exist in the DefaultFunction function, which allows a remote attacker to manipulate the system. Recommendations Update 3CORESec Trapdoor to version 1.2.3 or later. ...

PT-2026-69315

Name of the Vulnerable Software and Affected Versions Nikolaibibo claude-comfyui-mcp version 1.0.0 Description A path traversal issue exists in the comfy upload image component within the src/tools/utils.ts file. The copyFileSync function does not properly validate the image path argument, allowi...

CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...

CVE-2026-71951

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71951

D-Link DWR‑M961 devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108 are affected by a remote command‑injection in the /boafrm/formIMEISetup interface. The vulnerability allows an attacker to inject commands via the IMEI_value field, resulting in command execution with roo...

CVE-2026-71949 D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...

CVE-2026-71947

CVE-2026-71947 affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. The vulnerability resides in the /boafrm/formTracerouteDiagnosticRun interface, where a remote attacker can inject commands via the host and ipVer fields, leading to command exec...

CVE-2026-19263

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It i...