EUVD-2026-54301

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure...

CVE-2026-48039: Improper Authentication

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

CVE-2026-66829

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

EEF-CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

Summary URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps...

CVE-2026-66829

The CVE affects html_sanitize_ex (HtmlSanitizeEx.html5/1) where attacker-supplied meta refresh elements survive sanitization. The root cause is that a meta element can apply document-wide directives, enabling open redirects to user-chosen sites via a tag. Affected versions: html_sanitize_ex from...

CVE-2026-66829 html_sanitize_ex HTML5 scrubber keeps attacker-supplied meta refresh, allowing forced cross-origin redirection

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

EUVD-2026-54082

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...

@apicity/mcp-server (0.8.5) potentially affected by unknown CVE via @apicity/meta (0.8.5)

@apicity/meta NPM version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.5 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.4) potentially affected by unknown CVE via @apicity/meta (0.8.4)

@apicity/meta NPM version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.4 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.8) potentially affected by unknown CVE via @apicity/meta (0.8.8)

@apicity/meta NPM version 0.8.8 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.1) potentially affected by unknown CVE via @apicity/meta (0.8.1)

@apicity/meta NPM version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.6) potentially affected by unknown CVE via @apicity/meta (0.8.6)

@apicity/meta NPM version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.2) potentially affected by unknown CVE via @apicity/meta (0.8.2)

@apicity/meta NPM version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.3) potentially affected by unknown CVE via @apicity/meta (0.8.3)

@apicity/meta NPM version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

MAL-2026-13412 Malicious code in @apicity/meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload ho...

CVE-2026-18400

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-18400 Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-53714

The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...