EUVD-2026-70508

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no...

EUVD-2026-58724

CKAN MCP Server: Information disclosure via verbose error reflection...

GHSA-6F9W-9HF2-5RG3 CKAN MCP Server: Information disclosure via verbose error reflection

Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...

CKAN MCP Server: Information disclosure via verbose error reflection

Summary Error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a non-CKAN response, or when an internal exception occurs, the caller...

CVE-2026-85171

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

CVE-2026-85030

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routesagent.py of the component selfRegister API Endpoint. Such manipulation of the argument initialbalance leads to business...

CVE-2026-80745

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEGtable mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h - 7.04V -7.04V 05h - 7.26V -7.26V 06h - 7.49V...

erlang: Erlang OTP: Denial of Service via crafted SCTP ERROR chunk

A flaw was found in Erlang OTP Open Telecom Platform erts, specifically within the inetdrv component. An unauthenticated remote attacker can exploit a stack-based buffer overflow vulnerability by sending a specially crafted Stream Control Transmission Protocol SCTP ERROR chunk. This can lead to a...

CVE-2026-85171

n8n versions before 1.123.73 , 2.35.4 , and 2.36.2 are affected by a credential exposure vulnerability in the Strapi , SeaTable , and Mailcheck nodes. The root cause is that these nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any erro...

EUVD-2026-70406

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

CVE-2026-85171 n8n before 1.123.73 Credential Exposure via Error Logging

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

CVE-2026-85171 n8n before 1.123.73 Credential Exposure via Error Logging

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

CVE-2026-85171 n8n before 1.123.73 Credential Exposure via Error Logging

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

CVE-2026-80750 pmdomain: mediatek: fix remaining %pOF after of_node_put()

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

CVE-2026-80750 pmdomain: mediatek: fix remaining %pOF after of_node_put()

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after ofnodeput scpsysgetbusprotectionlegacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap...

Security update for python-msgpack

This update for python-msgpack fixes the following issue: CVE-2026-57585: reusing an Unpacker instance after an error has been caught can lead to an out-of-bounds read bsc1269947. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate ...

CVE-2026-85030

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routesagent.py of the component selfRegister API Endpoint. Such manipulation of the argument initialbalance leads to business...

CVE-2026-85030 HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error

A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routesagent.py of the component selfRegister API Endpoint. Such manipulation of the argument initialbalance leads to business...

CVE-2026-85030

HKUDS AI-Trader (a simulated trading/competition platform) contains a business logic error in the selfRegister API Endpoint within service/server/routes_agent.py. By manipulating the initial_balance argument, a remote attacker can inflate their starting cash/equity value. However, because profit_...