297762 matches found
CVE-2026-81684
openssl_encrypt (pip package openssl-encrypt) versions ≤ 1.4.8 contain an information disclosure flaw in its desktop GUI. The steganography password is passed to a CLI child process via the --stego-password command-line argument (on both encrypt and decrypt paths) rather than through an environme...
CVE-2026-81684 openssl_encrypt before 1.4.9 Information Disclosure via Command Line
In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...
CVE-2026-81684 openssl_encrypt before 1.4.9 Information Disclosure via Command Line
In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...
CVE-2026-81684 openssl_encrypt before 1.4.9 Information Disclosure via Command Line
In opensslencrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...
CVE-2026-81101
Airtable MCP CLI before 0.2.5 contained a credential-disclosure flaw in its configure command. The ConfigureCommand.execute method in src/cli.ts persisted a user-supplied endpoint URL without validating it through createSafeUrl in src/config.ts—the helper that already restricted the equivalent en...
EUVD-2026-67029
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...
CVE-2026-81101 Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...
CVE-2026-81101 Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...
CVE-2026-81101 Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...
CVE-2026-81097 rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...
EUVD-2026-67025
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...
CVE-2026-81097
rails-mcp-server (versions 1.4.0 through 1.6.0 ) contains an OS command execution vulnerability in the execute_ruby tool. The tool is documented as a read-only Ruby sandbox enforced by a pattern denylist and replacements for process-spawning methods on Kernel , but the pseudo-terminal library's s...
CVE-2026-81097 rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...
CVE-2026-81097 rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...
CVE-2026-81094
CVE-2026-81094 affects the mcp-router CLI (prior to version 0.6.3). The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port and enforced authentication only when an explicit token flag was supplied. A default invocation therefore expose...
CVE-2026-81094 mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...
CVE-2026-81094 mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...
EUVD-2026-67022
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...
CVE-2026-81094 mcp-router CLI before 0.6.3 Binds the MCP Aggregator to All Interfaces Without Requiring Authentication
The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding...
Security update for texlive
This update for texlive fixes the following issue: CVE-2026-63729: use-after-free in synctexparser.c in TeX Live bsc1272432. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comman...