PT-2026-59061

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create template of the file astrbot/dashboard/routes/t2i.py of the component Dashboard API. The manipulation results in improper neutralization of special elements used in a template engine. The...

PT-2026-59684

A security vulnerability has been detected in SGLang 0.5.10.post1. Impacted is an unknown function of the file python/sglang/srt/lora/lora manager.py of the component Inference HTTP Endpoint. Such manipulation of the argument lora path leads to reachable assertion. The attack can be launched...

PT-2026-59066

A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate favicon from url of the file src/auto favicon/server.py of the component MCP Tool. The manipulation of the argument image url results in server-side request...

PT-2026-59214

A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function get file id of the file libs/chatchat-server/chatchat/server/api server/openai routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently...

PT-2026-59291

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get mime type of the file metagpt/utils/common.py. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The project was...

PT-2026-60014

A vulnerability was identified in ByteDance verl up to 0.7.1. Affected is the function math equal of the file prime math/grader.py. The manipulation leads to a sandbox issue. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to ...

PT-2026-59222

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove api keys/has api terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be...

PT-2026-59225

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create project/encrypt auth settings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument auth...

PT-2026-59226

A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function get client ip/install mcp config of the file src/backend/base/langflow/api/v1/mcp projects.py of the component Model Context Protocol Configuration API. Performing a manipulation of the argument...

PT-2026-59151

A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add text of the component Arena Side-by-Side View Handler. The manipulation results in incorrect control flow. The attack can be launched remotely. The exploit is now public and may be used. The root cause was...

PT-2026-59286

A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle.dump of the file mem0/vector stores/faiss.py. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been made public and could be use...

PT-2026-59298

A weakness has been identified in MindsDB up to 26.01. This impacts the function exec of the file mindsdb/integrations/handlers/byom handler/proc wrapper.py of the component Engine Handler. Executing a manipulation can lead to unrestricted upload. The attack can be executed remotely. The exploit...

PT-2026-59303

A vulnerability was found in douinc mkdocs-mcp-plugin up to 0.4.1. This affects the function read document/list documents of the file server.py. Performing a manipulation of the argument docs dir/file path results in path traversal. The attack is possible to be carried out remotely. The exploit h...

PT-2026-59693

A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract to json of the file src/entry.py. Performing a manipulation of the argument output filename results in sql injection. Remote exploitation of the attack is possible. The exploit has...

PT-2026-57876

Name of the Vulnerable Software and Affected Versions EIPStackGroup OpENer version 2.3.0 commit 76b95cf Description An out-of-bounds read occurs in the Connection Manager when handling ForwardOpen requests during the processing of short malformed packets. An unauthenticated remote attacker can...

PT-2026-57642

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit has been released to the...

PT-2026-59014

A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function get bytes from web url of the file src/agentscope/ utils/ common.py of the component Internal Service. Performing a manipulation results in server-side request forgery. It is possible to initiate...

PT-2026-59200

A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare kaggle dataset of the file src/kaggle mcp/server.py. The manipulation of the argument competition id leads to path traversal. The attack is possib...

PT-2026-57614

A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scan project icons/sync icon. Such manipulation of the argument icons file leads to path traversal. An attack has to be approached locally. The exploit has been disclos...

PT-2026-57615

Name of the Vulnerable Software and Affected Versions lamaalrajih kicad-mcp versions prior to 3.3.2 Description A failure in the protection mechanism occurs during the processing of the file kicad mcp/utils/path validator.py. This issue can be triggered by manipulating the project path or schemat...