CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

acl: TOCTOU Symlink Traversal via getfacl/setfacl

A time-of-check to time-of-use TOCTOU race condition vulnerability was found in acl. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes...

EUVD-2026-46303

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls...

CVE-2026-47395

CVE-2026-47395 – PraisonAI CLI loopback/SSRF via @url: mentions Prior to PraisonAI v4.6.40 (and praisonaiagents v1.6.40), the direct-prompt CLI automatically expands @url:(http|https) prompts, performing an unrestricted urllib.request.urlopen() to the attacker-controlled URL. The fetched response...

CVE-2026-65051

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

CVE-2026-47390 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...

CVE-2026-47390 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...

EUVD-2026-46271

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

CVE-2026-15370

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370 Libssh: libssh: stack buffer overflow in sftp server longname construction

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370 Libssh: libssh: stack buffer overflow in sftp server longname construction

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead ...

CVE-2026-15370

CVE-2026-15370 is a vulnerability in libssh where, during SFTP server directory listing, the longname field is built by unsafe string concatenation into a fixed-size stack buffer. This can allow sufficiently long attacker-controlled filenames to overflow the stack, potentially crashing the server...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2749)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted the...

PT-2026-62095

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An inconsistency in the file access authorization logic allows a low-privileged authenticated user to retrieve, modify, and delete case attachments from feature areas they are not authorized t...

EulerOS Virtualization 2.10.1 : libcap (EulerOS-SA-2026-2825)

According to the versions of the libcap package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use TOCTOU race condition in the...

PT-2026-63264

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs when user-controlled keys are used, allowing an attacker to disclose information. This happens via user-supplied identifiers that reference scheduled query resul...

PT-2026-61954

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

GHSA-F283-GHQC-FG79 Guzzle: Unbounded response cookies risk denial of service

Impact In affected versions, Guzzle's built-in CookieJar accepts any number of Set-Cookie header fields from one response, with no limit on the size of each field. When a later request matches the stored cookies, Guzzle places every match into one generated Cookie header without limiting the numb...

Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

Summary Axios versions with Node.js HTTP/2 support allow streamed request bodies to bypass maxBodyLength enforcement when requests are sent with httpVersion: 2. This affects applications that rely on maxBodyLength as a hard cap while forwarding attacker-controlled streams, such as upload endpoint...