CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

EUVD-2023-31616

Malicious code in bioql PyPI...

CVE-2023-27881

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

Design/Logic Flaw

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

CVE-2023-27881

CVE-2023-27881 affects PTC Vuforia Studio. Affected: Vuforia Studio (all versions prior to 9.9). Vulnerability: Unrestricted Upload of File with Dangerous Type via the Upload Resource feature allows a user to upload files to arbitrary locations on disk. Impact: potential unauthorized file placeme...

CVE-2023-27881 PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type

A user could use the “Upload Resource” functionality to upload files to any location on the disk...

PT-2023-21392 · Ptc · Vuforia Studio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A user could use the “Upload Resource” functionality to upload files to any location on the disk. There is no additional information about the estimated...

CVE-2021-33576

An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filename can include path-traversal characters, allowing the file to be written to an arbitrary location on disk...

CVE-2017-6974

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the system-installation subsystem of the "System Integrity Protection" component. It allows attackers to modify the contents of a protected disk location via a crafted app...

CVE-2017-6974

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the system-installation subsystem of the "System Integrity Protection" component. It allows attackers to modify the contents of a protected disk location via a crafted app...