141426 matches found
PT-2026-59114
Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary run dbt command in src/dbt mcp/dbt cli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two...
PT-2026-59115
Background This vulnerability is found in the diffusers package - the transformers-equivalent library for diffusion models. It is found in the DiffusionPipeline.from pretrained flow, which is used to load a pipeline from the HuggingFace Hub. This function has a trust remote code guard: if the...
BIT-POSTGRESQL-JDBC-DRIVER-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms
pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to...
SUSE-SU-2026:22635-1 Security update for php8
This update for php8 fixes the following issues - Update to versio 8.4.23 - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...
OPENSUSE-SU-2026:21308-1 Security update for php8
This update for php8 fixes the following issues - Update to versio 8.4.23 - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...
[SECURITY] Fedora 44 Update: perl-Crypt-DSA-1.22-1.fc44
Crypt::DSA is an implementation of the DSA Digital Signature Algorithm signature verification system. This package provides DSA signing, signature verification, and key generation. DSA Digital Signature Algorithm signatures are no longer considered to be adequate for security. This module should...
[SECURITY] Fedora 43 Update: perl-Crypt-DSA-1.22-1.fc43
Crypt::DSA is an implementation of the DSA Digital Signature Algorithm signature verification system. This package provides DSA signing, signature verification, and key generation. DSA Digital Signature Algorithm signatures are no longer considered to be adequate for security. This module should...
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
The jscrambler npm package was compromised, and simply installing its 8.14.0 release runs an infostealer on your machine. Published on July 11, 2026, the malicious version carries a preinstall hook that drops and executes a native binary, one build each for Windows, macOS, and Linux. Socket flagg...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-46215 Exploit for Linux 7.0 - 7.8 & Linux Kernel 7.0-...
Exploit for CVE-2026-14894
CVE-2026-14894 — Super Forms ≤ 6.3.313...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Apache HTTP Server Path Traversal Contribut...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthe...
CVE-2026-14738
A flaw was found in exo. A remote attacker could exploit the use of a weak hashing algorithm within the imagecachekey function of the Vision Feature Cache component. This vulnerability, while difficult to exploit, could potentially allow an attacker to cause hash collisions, leading to a low impa...
Exploit for Integer Overflow or Wraparound in Linux Linux_Kernel
PACKETEDITMEME - CVE-2026-46331 net/sched actpedit parti...
Exploit for CVE-2024-13985
CVE-2024-13985 — Dahua EIMS capturehandle.action Remote Cod...
Exploit for CVE-2026-29114
CVE-2026-29114 — Dahua Exposed Device CA Root Certificate !...
Exploit for CVE-2026-29115
CVE-2026-29115 — Dahua Authenticated Remote Denial of Service...
Exploit for CVE-2026-29116
CVE-2026-29116 — Dahua Unauthenticated Remote Denial of Servic...
RCE (Remote Code Execution) form-data Dependency in Confluence Data Center
This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...