EUVD-2026-66114

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

CVE-2026-77357

Mesop is a Python-based UI framework for building web applications. Prior to 1.3.3 , applications running in debug mode expose a GET /hot-reload endpoint containing an unbounded loop that depends on a user-supplied counter parameter. An unauthenticated attacker can send a request with a high coun...

CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

EUVD-2026-65706

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. The vulnerability is a path traversal in the MCP server tools: export_state and import_state (in src/consciousness-explorer/mcp/server.js) and saveVectorToFile / loadVecto...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4rf-3fr8-xwx3. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function,...

GHSA-3H2G-J4WP-7QQQ Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4rf-3fr8-xwx3. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function,...

CVE-2026-55637

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

GHSA-P7X2-G5CQ-FHMQ mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Summary mediasoup's built-in SCTP stack introduced in v3.20.0 authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a per-instance HMAC keyed with a secret, violating RFC 9260 Section 5.1.3. An on-path attacker targeting a PlainTransport with SCTP enabled and no...

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Summary mediasoup's built-in SCTP stack introduced in v3.20.0 authenticates SCTP state cookies using only hardcoded magic byte sequences rather than a per-instance HMAC keyed with a secret, violating RFC 9260 Section 5.1.3. An on-path attacker targeting a PlainTransport with SCTP enabled and no...

Security Bulletin: Vulnerability in Faraday affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Faraday has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabili...

OPENSUSE-RU-2026:21658-1 Recommended update for sequoia-sq

This update for sequoia-sq fixes the following issues: Changes in sequoia-sq: - Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only LICENSE.txt confirms it Correct Legal-Review-Notice usage - Update dependencies due to security issues CVE-2026-25541 bsc1274437 - Switch crypto...

Security Bulletin: Vulnerability in jackson-databind affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in jackson-databind has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

GHSA-CMWV-WF9P-P8WX genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled Host and Origin headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request,...