32 matches found
CVE-2026-55546 QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...
CVE-2026-55546: Improper Control of Generation of Code
QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...
PT-2026-81349
Name of the Vulnerable Software and Affected Versions QWED-MCP versions prior to 0.2.1 Description The verify math expression function in src/qwed mcp/engines/math engine.py passes the expression and claimed result strings directly to SymPy's parse expr function. The implementation only normalize...
PT-2026-81397
Name of the Vulnerable Software and Affected Versions QWED versions prior to 5.1.2 Description Authenticated users can execute arbitrary Python code within the API server process because the qwed package passes user-controlled math expressions to the SymPy parse expr function without restricting...
CVE-2026-55585: Improper Control of Generation of Code
QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...
EUVD-2019-9385
Malware in sbrugna...
CVE-2019-19786
ATasm 1.06 has a stack-based buffer overflow in the parseexpr function in setparse.c via a crafted .m65 file...
Stack overflow
ATasm 1.06 has a stack-based buffer overflow in the parseexpr function in setparse.c via a crafted .m65 file...
CVE-2019-19786
ATasm 1.06 has a stack-based buffer overflow in the parseexpr function in setparse.c via a crafted .m65 file...
CVE-2019-19786
ATasm 1.06 has a stack-based buffer overflow in the parseexpr function in setparse.c via a crafted .m65 file...
CVE-2019-19786
CVE-2019-19786 concerns ATasm 1.06, with a stack-based buffer overflow in the parse_expr() function of setparse.c triggered by a crafted .m65 file. The Fedora-related advisories reference multiple ATasm CVEs for the same package (including CVE-2019-19786) and note updates to ATasm (e.g., 1.09) ad...