CVE-2026-81560

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The explo...

CVE-2026-34308

creationtimestamp| type| source ---|---|--- 2026-08-27 12:00:04+00:00| published-proof-of-concept| Telegram/9BtrUinGR09Vw-DDzgsbuAL7mkCqzQImOpJ5grPSV1xMots 2026-08-28 00:00:48+00:00| published-proof-of-concept| Telegram/9BtrUinGR09Vw-DDzgsbuAL7mkCqzQImOpJ5grPSV1xMots...

CVE-2026-81560 blackms aistack Static File server.ts path traversal

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The explo...

WordPress Content Protector (Passster) plugin < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability

Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Passster versions 4.3.6...

CVE-2026-81486 bsmi021 mcp-file-context-server Path Resolution index.ts read_context path traversal

A vulnerability was detected in bsmi021 mcp-file-context-server 1.0.0. Affected by this issue is the function readcontext of the file src/index.ts of the component Path Resolution. Performing a manipulation of the argument path results in path traversal. It is possible to initiate the attack...

CVE-2026-81486

bsmi021 mcp-file-context-server 1.0.0 contains a path traversal vulnerability in the Path Resolution component, specifically in the function read_context within src/index.ts. Manipulating the path argument allows an unauthenticated remote attacker to read files outside the intended directory, res...

CVE-2026-81421

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

EUVD-2026-66809

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=login2. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-82603

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to re-derive and validate fingerprints when loading identities from the identity.json file. This allows attackers to substitute legitimate public keys in identity stores wi...

PT-2026-82805

A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save pipeline/load pipeline of the file pipeline tools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been made public and...

CVE-2026-81421 ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421

CVE-2026-81421 affects ddfourtwo sentry-selfhosted-mcp 0.4.0 , where the raw_sentry_api component is vulnerable to server-side request forgery (SSRF) through manipulation of the endpoint argument. The vulnerability allows remote, unauthenticated attacks with low complexity. A Proof-of-Concept exp...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-44476 Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret

Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's clientid, which is public information, can authenticate as that client at the token endpoint and obtain an access token without providing its clientsecret. This occu...

CVE-2026-79804

A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown functionality of the file /search.php. Performing a manipulation of the argument searchbox results in sql injection. Remote exploitation of the...

CVE-2026-79845 code-projects Simple Inventory System edit.php sql injection

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly...

CVE-2026-79804

CVE-2026-79804 affects the SililaWijesinghe Food Ordering System (up to commit ba314e897e3365600461e5ea59432e39ceaa0fa5). The vulnerability is an SQL injection in the file /search.php, triggered by manipulating the search_box argument. It is exploitable remotely without authentication, yielding l...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through checkcertusable in ssl/t1lib.c. An attacker can crash a server or client by negotiating RFC7250 raw public keys and sending the TLS signaturealgorithmscert extension to a peer configured with only a...

CVE-2026-79622

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch...