deployme (>=0.1.0, <=0.5.0), limiter-for-sanic (>=0.0.7, <=0.1.0) +4 more potentially affected by CVE-2026-85078 via sanic (22.9.1)

sanic PYPI version 22.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - deployme =0.1.0, =0.0.7, =0.0.1, =0.0.47, =0.4.10 - mljet 0.7.0 Source cves: CVE-2026-85078 Source advisory: OSV:GHSA-WMJ6-G64G-J7Q5...

Astra Linux – Vulnerability in gpac

A vulnerability was discovered in GPAC version 2.4. It has been rated as problematic. The affected function is gfdashdownloadinitsegment in the file src/mediatools/dashclient.c. Manipulating the baseiniturl argument leads to a null pointer dereference. This attack can be launched remotely. The...

CVE-2026-79513

A divide-by-zero vulnerability in the gfdashgettimelineduration function src/mediatools/dashclient.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

EUVD-2026-75167

A divide-by-zero vulnerability in the gfdashgettimelineduration function src/mediatools/dashclient.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

PT-2026-89146

A divide-by-zero vulnerability in the gf dash get timeline duration function src/media tools/dash client.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

CVE-2026-79513

A divide-by-zero vulnerability in the gfdashgettimelineduration function src/mediatools/dashclient.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

CVE-2026-85626

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-85626

git-mcp-server 2.15.1 is affected by an argument injection vulnerability in the ref and object parameters of the git_log, git_diff, and git_show tools. The root cause is a lack of leading-dash validation , allowing attackers to inject git command-line options such as --output= and write files out...

CVE-2026-85626 git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

EUVD-2026-71233

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-85626 git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

Malicious code in conventional-changelog-dash (npm)

Source: amazon-inspector 881ccc3d6c947645ee3866499931db298b0f2f7ac4a3d41dd9acf806d4e6d702 The package conventional-changelog-dash was found to contain malicious code. Source: ossf-package-analysis 1622588781d04a8895e9fdcf59dc2136a5e6847fd341501a6e08677a8a528164 The OpenSSF Package Analysis projec...

PT-2026-85550

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git log, git diff, and git show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-75146

A flaw was found in FFmpeg. A malicious or misconfigured DASH Dynamic Adaptive Streaming over HTTP server can exploit an out-of-bounds read vulnerability in the DASH demuxer. This occurs when a live DASH manifest is refreshed with a startNumber that is lower than the previous value, causing a...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102 Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102 Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81102

CVE-2026-81102 affects the Dropbox Dash MCP server (src/mcp_server_dash.py), which in its network mode bound its listener to the loopback address but never validated the Host header , and included no transport-security settings. This allowed a DNS rebinding attack: a malicious page in a visitor's...

EUVD-2026-67030

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...