13356 matches found
firefox: thunderbird: Sandbox escape in the DOM: Workers component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Workers component...
PT-2026-60301
Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.28.1 Description The MCP Python SDK, a Python implementation of the Model Context Protocol, contains an issue in the deprecated mcp.server.websocket.websocket server transport. This component accepts WebSocket handshake...
PT-2026-60247
GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port...
CVE-2026-15752
CVE-2026-15752 affects the backend user endpoint of zhinianboke xianyu-auto-reply, specifically an issue in an unknown function under the file path /api/v1/users/ that permits remote manipulation leading to missing authorization. The vulnerability is linked to a rolling-release project with no pu...
CVE-2026-48125
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...
CVE-2026-48125 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`
UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application th...
CVE-2026-48257
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
CVE-2026-48255
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
CVE-2026-48260
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
CVE-2026-48260 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
CVE-2026-48255 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...
CVE-2026-48257
CVE-2026-48257 : Adobe Experience Manager is affected by a DOM-based XSS vulnerability. An attacker could manipulate the DOM to run malicious JavaScript in the victim’s browser, with exploitation requiring the user to visit a crafted webpage. The CVSS v3.1 base score is 5.4 (Medium) with network ...
firefox: thunderbird: Sandbox escape in the DOM: Navigation component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Navigation component...
CVE-2026-50331
Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally...
GHSA-QW5R-PPCG-F8RJ MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion
Unbounded Pod Log Read via Attacker-Controlled limitBytes/tailLines Causes Memory Exhaustion Summary The MKP Model Context Protocol for Kubernetes server exposes a getresource MCP tool that proxies Kubernetes pod log requests. User-supplied limitBytes and tailLines parameters are parsed as...
CVE-2026-50331 Windows Application Model Core API Elevation of Privilege Vulnerability
...
CVE-2026-50331
CVE-2026-50331 is a Windows Application Model Core API elevation-of-privilege vulnerability caused by a use-after-free issue. It affects the Windows Application Model Core API component and allows an authorized attacker with local access to elevate privileges. Microsoft has issued updates to addr...
CVE-2026-50331 Windows Application Model Core API Elevation of Privilege Vulnerability
...
Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...
