npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes vulnerability discovered by ? in WordPress npm obsidian-tc versions = 1.0.1, = 1.31.3...

EUVD-2026-64270

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin...

SUSE CVE-2026-113721

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...

CVE-2026-115478

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate memory notes from SQLite at the computed memory//.md path without reliably preserving note...

CVE-2026-57208

Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository to craft malicious checkpoint metadata that causes entire session resume or entire checkpoint...

CVE-2026-115478 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate memory notes from SQLite at the computed memory//.md path without reliably preserving note...

CVE-2026-115478

The obsidian-tc Model Context Protocol server (versions 1.0.1 through 1.31.4 ) contains a memory-lifecycle flaw where the create_entity, link_entities, rename_entity, unlink_entities, and delete_entity tools can overwrite unowned vault notes. This occurs because the software regenerates notes fro...

EUVD-2026-109083

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate memory notes from SQLite at the computed memory//.md path without reliably preserving note...

CVE-2026-115478 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, createentity, linkentities, renameentity, unlinkentities and deleteentity regenerate memory notes from SQLite at the computed memory//.md path without reliably preserving note...

CVE-2026-115478

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, "createentity", "linkentities", "renameentity", "unlinkentities" and "deleteentity" regenerate memory notes from SQLite at the computed "memory//.md" path without reliably preserving...

CVE-2026-115724

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

CVE-2026-115724 VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

CVE-2026-115724

VLC for Android before version 3.7.2 is vulnerable to a confused-deputy file overwrite vulnerability within the FileUtils.getUri() function. The issue arises because the application trusts content URIs based solely on the com.fsck.k9.attachmentprovider or gmail-ls authorities. A co-installed appl...

EUVD-2026-108712

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

CVE-2026-115724 VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

php2shell

php2shell PHP proof of concept for CVE-2026-109618 / CV...

CVE-2026-94267

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-112230

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...

EUVD-2026-108604

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-112230 Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests, allowing unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data...