13252 matches found
PT-2026-61882
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the DOM: Networking component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...
PT-2026-61878
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A privilege escalation issue exists within the DOM Navigation component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...
PT-2026-61911
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A site isolation issue exists within the DOM Navigation component. Site isolation is a security mechanism that ensures web pages from different sites are processed in...
PT-2026-61912
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description An information disclosure issue exists within the DOM Security component...
CVE-2026-64651 AI SDK OpenCode Harness Tool Relay Authorization Bypass
The @ai-sdk/harness-opencode tool connects HarnessAgent to OpenCode through a sandboxed bridge. Prior to version 1.0.28, the tool relay authorizes requests from any process whose command line contains an allowed helper script path host-tool-mcp.mjs. This allows untrusted code executing in the...
CVE-2026-64651
The CVE-2026-64651 entry concerns the @ai-sdk/harness-opencode tool that connects HarnessAgent to OpenCode via a sandboxed bridge. Before version 1.0.28, the tool would relay requests from any process whose command line included an allowed helper script path (host-tool-mcp.mjs), enabling untruste...
CVE-2026-46555
The CVE applies to WhatsApp MCP Server, where the whatsapp-bridge HTTP API on 127.0.0.1:8080 is unauthenticated and lacks Host header validation. The /api/send endpoint accepts an absolute media_path, enabling a local caller (including sibling MCP servers, IDE extensions, or other processes in th...
CVE-2026-32822
Technical details are not publicly available in the provided documents. No specific affected versions, vulnerable components, or fixes are disclosed here. Monitor for updates.
PT-2026-61653
Name of the Vulnerable Software and Affected Versions WhatsApp MCP Server versions prior to 0.2.1 Description The whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication or Host header validation. Additionally, the /api/send endpoint accepts an absolute media path parameter...
PT-2026-61603
Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description An improper isolation issue allows an administrator with sufficient entitlements to impor...
Vulnerability of the DOM component: Mozilla Firefox’s navigation feature, which allows attackers to compromise the privacy and integrity of protected information.
Vulnerability of the DOM component: Mozilla Firefox’s navigation mechanism is associated with deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of protected information...
MINI-44RF-65XX-545P
Bulletin has no description...
EUVD-2026-45423
A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to...
CVE-2026-16212
A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to...
PT-2026-61046
A vulnerability was identified in awesto django-shop up to 1.2.4. Affected is an unknown function of the file shop/models/inventory.py of the component Purchase Stock Handler. The manipulation leads to race condition. The attack is possible to be carried out remotely. The attack is considered to...
MINI-H25X-FRQ6-733C
Bulletin has no description...
MINI-VGXF-644W-457V
Bulletin has no description...
MINI-MQ6G-XRWW-X4MP
Bulletin has no description...