EUVD-2026-65706

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. The vulnerability is a path traversal in the MCP server tools: export_state and import_state (in src/consciousness-explorer/mcp/server.js) and saveVectorToFile / loadVecto...

CVE-2026-55609: External Control of File Name or Path

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

PT-2026-82010

Impact An arbitrary file write vulnerability CWE-73, External Control of File Name or Path exists in the consciousness-explorer component of sublinear-time-solver. The MCP export state and import state tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync /...

PT-2026-81473

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export state and import state tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-30512

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

EUVD-2026-63106

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

CVE-2026-76254

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

CVE-2026-76254

Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14 are affected. Dataset Explorer fails to validate or escape dataset names when building SPL searches and skips SPL safeguards for risky commands, enabling a phishing attack to execute arbitrary SPL under the victim's privi...

CVE-2026-76254 SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

CVE-2026-76254 SPL Command Safeguards Bypass through Splunk Web in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

Exploit for Cross-site Scripting in Prometheus

CVE-2026-40179 — Prometheus stored XSS via remotewrite A m...

PT-2026-78726

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Enterprise versions prior to 9.3.14 Description An unauthenticat...

CVE-2026-76254: Improper Neutralization of Special Elements in Data Query Logic

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, 9.4.14, and 9.3.14, an unauthenticated user could cause another user to dispatch arbitrary Search Processing Language SPL pipelines from Dataset Explorer with the same privileges as that user, which can allow for access to all relevant...

BIT-DISCOURSE-2026-72731 Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Discourse is an open-source discussion platform. From 2026.1.0 until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and...

PT-2026-73258

Discourse is an open-source discussion platform. From 2026.1.0 until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and...

hulak v0.3.32

Git-native API client with encrypted secrets. REST · GraphQL · OAuth Quick Start • GraphQL Explorer • Project Layout • Documentation Run one request, a whole directory, or stay interactive root@kitploit: hulak run ./requests/ Hulak runs request files directly from your project. It supports...