CVE-2026-79748

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

CVE-2026-79745

MCPHub is a unified hub for centrally managing and orchestrating multiple MCP servers/APIs. Prior to version 1.0.32 , the built-in prompt and resource controllers perform no role checking — the mutating POST/PUT routes for /api/prompts* and /api/resources* are attached to the authenticated router...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

WordPress Charitable plugin <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute vulnerability

Authenticated Contributor+ SQL Injection via 'order' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Charitable versions = 1.8.12.1...

CVE-2015-8562

CVE-2015-8562 - Reverse shell Python Exploit: Joomla 1.5 - 3.4.5 Object Injection RCE X-Forwarded-For header: root@kitploit: Fecha de vulnerabilidad: 17/12/2015 Autor del exploit: anarc0der Versión: Joomla 1.5 a 3.4.5 CVE : CVE-2015-8562 Cómo usar: root@kitploit: Abre un terminal y escucha con nc...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'productorder' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP EasyCart versions = 5.9.2...

CVE-2026-75132

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

WordPress Photo Gallery by Ays plugin <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Photo Gallery by Ays versions = 6.8.2...

WordPress LearnPress plugin <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin LearnPress versions = 4.4.4...

K000163140: Python vulnerability CVE-2026-1502

Security Advisory Description CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has evaluated the currently supported releases for...

CVE-2026-82703

A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component aspsetPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The...

CVE-2026-82702

A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component aspWlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-82701

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

CVE-2026-59111

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.6.3. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

CVE-2026-75132

WAPT Server versions 2.6.1.17834 and earlier contain a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT, allowing them to...

EUVD-2026-68606

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.5.5. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.4.6. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 3.3.22. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installati...