cve-mcp-server

cve-mcp-server Realtime CVE intelligence over the Model Conte...

SUSE CVE-2026-49146

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack...

CVE-2026-93982: Insertion of Sensitive Information into Log File

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and acces...

DEBIAN-CVE-2026-57225

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed...

CVE-2026-57225

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed...

CVE-2026-57225 Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed...

CVE-2026-57225 Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed...

CVE-2026-57225

Suricata , a network Intrusion Detection and Prevention System, is vulnerable to a NULL pointer dereference in versions 8.0.0 through 8.0.6 . The flaw exists in src/datasets-context-json.c, where the engine incorrectly assumes that a configured JSON or NDJSON dataset value_key will always resolve...

EUVD-2026-83391

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed...

CVE-2026-57225 Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset valuekey resolves to a string. A trusted or untrusted dataset or rule feed...

CVE-2026-92702 Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier sets Policy.ReportData only when its caller supplies non-empty expected reportData. A relying-party integration that passes nil or empty expected reportData...

Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via InputProcessor.validatemodelinput in the /v1/embeddings and /pooling endpoints, which validates only the uppe...

EUVD-2026-82911

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93592 vLLM before 0.28.0 Denial of Service via negative token ID

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

EUVD-2026-82677

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

CVE-2026-88825 iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

CVE-2026-85127 VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

EUVD-2026-82667

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

Exploit for CVE-2009-3103

MS09-050 — SMBv2 Remote Code Execution Exploit CVE-2009-310...

SUSE CVE-2026-69147

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions and Responses can set mediaiokwargs.video.videobackend to pynvvideocodec, and MediaConnector.fetchvideo forwards that choice to VideoMediaIO even when startup configuration...