Linux Distros Unpatched Vulnerability : CVE-2026-66738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...

CVE-2026-72584: Time-of-check Time-of-use (TOCTOU) Race Condition

A time-of-check/time-of-use TOCTOU race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes...

CVE-2026-19372

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19368 PV-Bhat gemsuite-mcp gemini_search unified-gemini.ts path traversal

A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component geminisearch/geminireason/geminiprocess/geminianalyze. The manipulation of the argument filepath/filepaths results in path...

CVE-2026-19368

PV-Bhat gemsuite-mcp 1.0.0 contains a path traversal vulnerability in src/handlers/unified-gemini.ts (component chain gemini_search/gemini_reason/gemini_process/gemini_analyze). The issue arises from manipulation of the argument file_path/file_paths, which can be exploited from a local position. ...

EUVD-2026-54935

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject...

CVE-2026-19326 Jevon-Zhong Ai-doctor filemanagement.service.ts deleteImage path traversal

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

CVE-2026-19326

CVE-2026-19326 affects Jevon-Zhong Ai-doctor 0.0.1. The vulnerability is in the deleteImage function of ai-doctor-server/src/filemanagement/filemanagement.service.ts, where manipulating the imagePath argument enables path traversal. Local access is required. The project was informed via an issue ...

EUVD-2026-54853

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

PT-2026-69299

Name of the Vulnerable Software and Affected Versions 3CORESec Trapdoor versions prior to 1.2.3 Description Improper access controls exist in the DefaultFunction function, which allows a remote attacker to manipulate the system. Recommendations Update 3CORESec Trapdoor to version 1.2.3 or later. ...

PT-2026-69315

Name of the Vulnerable Software and Affected Versions Nikolaibibo claude-comfyui-mcp version 1.0.0 Description A path traversal issue exists in the comfy upload image component within the src/tools/utils.ts file. The copyFileSync function does not properly validate the image path argument, allowi...

Linux Distros Unpatched Vulnerability : CVE-2026-19017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA...

CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...

CVE-2026-71951

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71951

D-Link DWR‑M961 devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108 are affected by a remote command‑injection in the /boafrm/formIMEISetup interface. The vulnerability allows an attacker to inject commands via the IMEI_value field, resulting in command execution with roo...

CVE-2026-71949 D-Link DWR-M961 Command Injection via /boafrm/formUSSDSetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...

CVE-2026-71947

CVE-2026-71947 affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. The vulnerability resides in the /boafrm/formTracerouteDiagnosticRun interface, where a remote attacker can inject commands via the host and ipVer fields, leading to command exec...

CVE-2026-19263

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It i...

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-44092

A flaw was found in ModbusServer. An unauthenticated remote attacker can inject malicious input into the application due to a lack of input validation when fetching data from MQTT. This vulnerability may lead to a loss of data integrity and system availability...