CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743

MCPHub is a unified hub for managing and orchestrating MCP servers/APIs. Prior to version 0.12.13 , its MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field is directly concatenated into a file path without sanitization or path traversal character validatio...

EUVD-2026-68691

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal via customdirectoryname Merge Tag vulnerability discovered by nudien in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.12...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-6321)

Summary A hostname parsing discrepancy vulnerability in the fast-uri URI parsing library CVE-2026-6321 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-6321 DESCRIPTION: fast-uri decoded percent-encode...

Important: Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

open-iscsi: open-iscsi: Privilege Escalation via Path Traversal

A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...

CVE-2026-19880

A flaw was found in Logback-classic. This path-traversal vulnerability allows a remote attacker to create and append log files outside the intended directory. This occurs because an unsanitized discriminator value, influenced by the attacker for example, via an HTTP header, is used in a file path...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

EUVD-2026-68519

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

Eclipse Theia versions 1.73.0 through 1.74.9 are affected by a path traversal vulnerability in the AI "Agent Mode" file-change tools (writeFileContent , suggestFileContent , and related helpers). The root cause is the absence of a workspace-containment check on model-supplied file paths, allowing...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

[SECURITY] [DLA 4764-1] libdbi-perl security update

Debian LTS Advisory DLA-4764-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 31, 2026 https://wiki.debian.org/LTS Package : libdbi-perl Version : 1.643-3+deb11u2 1.643-4+deb12u2 CVE ID : CVE-2026-14380 CVE-2026-14739 CVE-2026-14740 CVE-2026-15043...

WordPress 爱采集数据采集和发布插件 plugin <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write vulnerability

Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin 爱采集数据采集和发布插件 versions = 1.0.0...

CVE-2026-70449

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package...

CVE-2026-70449

Apache Wicket versions 8.18.0 and before, 9.23.0 and before, and 10.10.0 and before are vulnerable to a Directory Traversal vulnerability. The issue stems from improper validation of locale , style , and variation attributes decoded from package resource URLs. Because these attributes are spliced...