58302 matches found
PT-2026-57839
Name of the Vulnerable Software and Affected Versions mcp-gitlab versions prior to 2.1.18 Description A path traversal issue exists in the job id parameter within the build/index.js file. This allows attackers to escape the intended path prefix by providing crafted values, such as ../../../user, ...
PT-2026-59357
Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...
MAL-2026-10210 Malicious code in mcp-notes-server-poc-praetorian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...
MAL-2026-10205 Malicious code in library-explorer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...
Malicious code in api-changelly (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...
MINI-F9H9-4GJG-2HW5
Bulletin has no description...
MINI-G4HV-862H-JJC7
Bulletin has no description...
MINI-3VPW-656G-Q24W
Bulletin has no description...
CVE-2026-10664
The nRF70 Wi-Fi driver's power-save event handler nrfwifieventprocgetpowersaveinfo in drivers/wifi/nrfwifi/src/wifimgmt.c copied TWT Target Wake Time flow entries from an nrfwifiumaceventpowersaveinfo event into the fixed-size twtflowsWIFIMAXTWTFLOWS 8-element array of a caller-supplied struct...
MINI-438X-47P7-6Q99
Bulletin has no description...
MINI-3HXQ-2853-WJ34
Bulletin has no description...
GHSA-3GJH-29FV-8HR6
creationtimestamp| type| source ---|---|--- 2026-07-12 12:51:29+00:00| seen| https://gist.github.com/MattHintz/18acc078a9239f65f06d48e0e8ada1e3...
EUVD-2026-43232
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal orgid and providerid values. Attackers can enumerate email domains to build mappings of domains to organization UUIDs and SSO provider identifiers...
CVE-2026-56336
Capgo before 12.128.2 contains an information-disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values. Attackers can enumerate email domains to map domains to organization UUIDs and SSO provider identifiers, enabling r...
CVE-2026-15494
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switchstatus.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and...
CVE-2026-15494 AMTT Hotel Broadband Operation System switch_status.php sql injection
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switchstatus.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and...
CVE-2026-15484
CVE-2026-15484 affects TRENDnet TEW-821DAP (firmware 1.12B01). The vulnerable element is the function sub_41EC14 in /goform/tools_nslookup of the ssi component, where input manipulation leads to a buffer overflow. Exploitation is described as possible to perform remotely via network. The vendor n...
CVE-2026-10660
creationtimestamp| type| source ---|---|--- 2026-07-11 17:28:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqf6sm6c6o2f 2026-07-11 19:32:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqffoyschb2q...
CVE-2026-61454
creationtimestamp| type| source ---|---|--- 2026-07-11 14:33:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqeuzo3gme2w 2026-07-11 16:07:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqf2azlsnp27 2026-07-13 17:32:26+00:00| seen|...