1397 matches found
CVE-2026-102242
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102242
The Google MCP Toolbox for Databases (versions 1.2.0 through 1.9.0 ) is vulnerable to a path traversal flaw due to improper link resolution (CWE-59 / CWE-22 ) in the allowedLocalRoots path validation. Because the system performs lexical path validation without first resolving symbolic links , a r...
EUVD-2026-89186
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102242: Improper Link Resolution Before File Access
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
PT-2026-102751
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-101092
SiYuan versions before v3.8.4 are vulnerable to an information disclosure flaw in the getCurrentAttrViewImages endpoint. The root cause is a failure to enforce publish-access checks , which allows users with publish reader permissions to retrieve image asset paths and filenames from unauthorized ...
CISA: Recognizing and Addressing Threats to Statewide Voter Registration Databases
Recently declassified records revealed that China breached multiple state voter registration systems prior to the 2020 election. Unfortunately, this is not a new phenomenon. Unclassified reports from the last decade reveal that Statewide Voter Registration Databases VRDB are attractive targets fo...
CVE-2026-92788 Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...
One Is Not Enough: The Untold Story of Multiple Security Patches for One Vulnerability
Security patches SPs are the main mechanism for fixing software vulnerabilities, yet a single vulnerability is not always resolved by a single patch: fixes may be completed incrementally, propagated across maintained branches, or replicated across related repositories. When patch records are...
EUVD-2026-72012
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...
PT-2026-86416
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...
BIT-NEO4J-ENTERPRISE-2026-1497 Incorrect privilege assignment in composite databases
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any...
GO-2026-6288 MCP Toolbox for Databases has an Origin Validation Error in github.com/googleapis/genai-toolbox
MCP Toolbox for Databases has an Origin Validation Error in github.com/googleapis/genai-toolbox...
PYSEC-2026-3736
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access...
CVE-2026-79674 NLTK 3.10.2 Path Traversal via corpus-reader constructors
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access...
PT-2026-82037
MCP Toolbox for Databases has an Origin Validation Error in github.com/googleapis/genai-toolbox...
RAD: Rule-Augmented Relational Anomaly Detection
Anomaly detection is often applied to data stored in relational databases, yet most existing methods require flattening multiple tables into a single feature matrix. This flattening can obscure entity identity, schema structure, and multi-hop dependencies, limiting the detection of anomalies that...