CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...

CVE-2026-77955 affecting package unbound for versions less than 1.26.1-1

CVE-2026-77955 affecting package unbound for versions less than 1.26.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-88062 OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

ROOT-OS-DEBIAN-12-CVE-2025-38154 CVE-2025-38154 in linux - Patched by Root

Root has patched CVE-2025-38154 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-40070 CVE-2025-40070 in linux - Patched by Root

Root has patched CVE-2025-40070 in the linux package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

ROOT-OS-UBUNTU-2204-CVE-2026-52963 CVE-2026-52963 in linux - Patched by Root

Root has patched CVE-2026-52963 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

Exploit for CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injec...

CVE-2026-62315 Frappe: Mass assignment via set_value

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-63654

Frappe (full-stack web application framework) versions 16.31.0 and earlier contain a vulnerability in the frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py. The whitelisted endpoint is not restricted to POST , meaning it accepts safe HTTP methods (e.g., GET) for st...

CVE-2026-55586

SumatraPDF 3.6.1 and earlier (Windows) contains a heap out-of-bounds write in the vendored CHMLib LZX decompressor. A crafted CHM file can supply malformed Huffman code lengths to make_decode_table in ext/CHMLib/lzx.c. In the long-code branch, internal nodes are written via next_symbol before val...

EUVD-2026-63480

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

PT-2026-79105

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set value in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. A...

PT-2026-79106

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk workflow approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

PT-2026-79089

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle like and mark as seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying liked by metadata or a Note seen state. An...

PT-2026-80792

Name of the Vulnerable Software and Affected Versions Drupal Link content parser affected versions not specified Description A security issue exists within the Drupal Link content parser. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2026-80790

Name of the Vulnerable Software and Affected Versions Drupal Gammu SMS Daemon versions . Description A security issue exists in the Drupal Gammu SMS Daemon project. The project is currently marked as unsupported, and the security flaw remains unaddressed by the maintainer. Recommendations At the...

MINI-8XH7-CQ46-FFRJ

Bulletin has no description...

MINI-2X84-H83P-C75C

Bulletin has no description...

CVE-2026-73849

In CVE-2026-73849, Emlog (2.6.26 and earlier) allows unauthenticated reinstall via install.php?action=reinstall. The code path bypasses the already-installed guard when act != 'reinstall', letting a remote attacker submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email...