CVE-2026-92598

creationtimestamp| type| source ---|---|--- 2026-09-16 23:07:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dmuesjrtqcdwt...

CVE-2026-19033

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:37+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-81736

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:37+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-81563

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:36+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-80274

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:36+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-19667

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:36+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-77692

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:36+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-19666

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:36+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-76163

creationtimestamp| type| source ---|---|--- 2026-09-16 23:04:36+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mvoasfpe4c22...

CVE-2026-92599

creationtimestamp| type| source ---|---|--- 2026-09-16 23:01:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/djdpmjjyqvynx...

CVE-2026-61594

creationtimestamp| type| source ---|---|--- 2026-09-16 22:31:42+00:00| seen| https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a 2026-09-17 00:00:37+00:00| seen| https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a 2026-09-17 00:09:20+00:00| seen|...

CVE-2026-92592

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

CVE-2026-92593

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

CVE-2026-92589

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92586

AVideo through 29.0 commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify video access permissions in the setapicomment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can submit POST requests to the comment API endpoi...

CVE-2026-92581

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-92580

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php line 270 the stored SSH password is substituted into the command string sshpass -p 'password' rsync ... with a plain strreplace and no escaping, so a single quote in...

CVE-2026-92579

In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of LocalSessionManager by sending a well-formed JSON-RPC POST that is not an InitializeRequest. The Streamable HTTP server's handlepost allocates the session before it validates the...

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

Summary The rmcp library does not validate the resource parameter in OAuth Protected Resource metadata RFC 9728, allowing a malicious MCP server to redirect OAuth flows to a legitimate authorization server and steal the resulting access tokens. Details RFC 9728 specifies two MUST requirements for...