EUVD-2026-78886

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

CVE-2026-54547

meta-ads-mcp is a Model Context Protocol server for Meta Ads by Pipeboard. Prior to version 1.0.115, an authentication bypass in AuthInjectionMiddleware (http_auth_integration.py:259) lets an unauthenticated network caller send any X-Pipeboard-Token header value to pass the request guard. Because...

CVE-2026-54547 Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in metaadsmcp/core/httpauthintegration.py rejects HTTP MCP requests only when both authtoken and pipeboardtoken are absent, while extracttokenfromheaders doe...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

gnutls: Fix of CVE-2026-42012

CVE-2026-42012: URI subjectAltName now precludes Common Name fallback in hostname verification...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback

A flaw was found in PCRE2. An attacker can provide invalid UTF Unicode Transformation Format data, leading to an out-of-bounds read during a Just-In-Time JIT fallback. This vulnerability could potentially result in a denial of service...

SUSE-SU-2026:23740-1 Security update for pcre2

This update for pcre2 fixes the following issues: - CVE-2026-86145: missing size checks in pcre2dfamatch code can lead to an out-of-bounds write bsc1279893. - CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback bsc1280054. - CVE-2026-89157: out-of-bounds write via large...

SUSE-SU-2026:23840-1 Security update for pcre2

This update for pcre2 fixes the following issues: - CVE-2026-86145: missing size checks in pcre2dfamatch code can lead to an out-of-bounds write bsc1279893. - CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback bsc1280054. - CVE-2026-89157: out-of-bounds write via large...

CVE-2026-59178

ESPHome Device Builder Dashboard prior to version 1.0.12 silently loses dashboard authentication after an upgrade. The root cause is that authentication credentials were read from $USERNAME/$PASSWORD in earlier versions, but after being renamed to $ESPHOME_USERNAME/$ESPHOME_PASSWORD, the bare nam...

CVE-2026-61701

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

EUVD-2026-77617

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

CVE-2026-61701

Laravel MagicLink (versions 2.0.0 through 2.25.1) is vulnerable to insecure deserialization of serialized action objects stored in the magic_links.action database column. The deserialization path in src/MagicLink.php and src/Actions/ResponseAction.php relies on an unsafe legacy unserialize() fall...

CVE-2026-59638

A flaw was found in Bouncy Castle for Java. The Java Secure Socket Extension JSSE hostname verifier incorrectly enables the Common Name CN fallback by default, despite it being documented as an opt-in feature. This misconfiguration could allow a remote attacker to bypass proper hostname validatio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: Fixed the detection of protocol fallback using BPF. The sockmap feature allows for BPF syscall from user space, or based on BPF sockops, replacing the skprot of sockets during protocol stack processing with sockmap’s...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinjecting Jakub reported a MPTCP deadlock at the time of fallback: WARNING: possible recursive locking detected 6.18.0-rc7-virtme 1 Not tainted -------------------------------------------...

Astra Linux – Vulnerability in libde265

It was discovered that Libde265 v1.0.8 contains a stack-buffer-overflow vulnerability through the use of putqpelfallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service DoS attack using a specially crafted video file...