CVE-2026-7206 dubydu sqlite-mcp entry.py extract_to_json sql injection

A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extracttojson of the file src/entry.py. Performing a manipulation of the argument outputfilename results in sql injection. Remote exploitation of the attack is possible. The exploit has been...

Notes MCP server 路径遍历漏洞

Notes MCP Server is a text content collaboration management tool developed by Edvard Lindelof. Versions of Notes MCP Server prior to 0.1.4 contained a path traversal vulnerability. This vulnerability stemmed from incorrect handling of parameters rootdir and path in the notesmcp.py file, which cou...

Papers MCP Server 路径遍历漏洞

Papers MCP Server is a scholarly paper management and MCP protocol service tool developed by Byron Duarte. There is a path traversal vulnerability in Papers MCP Server. This vulnerability stems from the incorrect handling of the topic parameter in the searchpapers function in the src/main.py file...

pyOpenSSL: DTLS cookie callback buffer overflow

A flaw was found in pyOpenSSL. The setcookiegeneratecallback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a...

CVE-2026-6980

A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repopath of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been...

EUVD-2026-25656

A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repopath of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been...

CVE-2026-41206

creationtimestamp| type| source ---|---|--- 2026-04-14 23:19:41+00:00| published-proof-of-concept| https://github.com/ParzivalHack/PySpector/security/advisories/GHSA-vp22-38m5-r39r...

MAL-2026-2569 Malicious code in bloxy-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 943946978741dfa911109b549544e9c3fc70eb20bd14505039ea3d0f52625d77 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

FreeBSD : py-ormar -- vulnerabilities (8d549898-3598-11f1-a8bc-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 8d549898-3598-11f1-a8bc-3c7c3fba4204 advisory. https://github.com/ormar-orm/ormar/security/advisories reports: Tenable has extracted the...

MAL-2026-2561 Malicious code in robase-help (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b83143e22b0a815d6a2702f547ae9f4620ee086c8b9360a0d60ff2ed2186d56b During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in robase-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e68a1df331005b75fc4c5e3aac4adf912ec273dd9c6fa671128aa73c96e3a935 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

GPT Researcher 代码注入漏洞

GPT Researcher is an AI-based deep research agent tool developed by Assaf Elovic as a personal development tool. Versions of GPT Researcher 3.4.3 and earlier have a code injection vulnerability, which stems from improper handling of the backend/server/app.py file. This vulnerability may lead to...

CVE-2026-5596

A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools/sql/tool.py of the component SqlTool. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now...

Fedora 44 : pyOpenSSL (2026-5697f4e025)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5697f4e025 advisory. Update to version 26.0.0 - Added support for using aws-lc instead of OpenSSL. - Properly raise an error if a DTLS cookie callback returned a cookie...

PT-2026-28719

Name of the Vulnerable Software and Affected Versions PromtEngineer localGPT versions prior to 4d41c7d1713b16b216d8e062e51a5dd88b20b054 Description A flaw exists in PromtEngineer localGPT that allows for unrestricted file upload. The issue is located in the do POST function within the...

SUSE CVE-2019-16227

An issue was discovered in py-lmdb 0.97. For certain values of mnflags, mdbcursorset triggers a memcpy with an invalid write operation within mdbxcursorinit1. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker...

CVE-2026-4513

A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function ask of the file vanna\legacy\base\base.py. Performing a manipulation results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. T...

CVE-2026-33057

Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally without authentication measures, yielding standard...

Malicious code in hash-utils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4177b7c46ecbfa35116b35a2a491107d0514cd6551a447b7213ef6e097172939 During importing the module, the code attempts to exfiltrate sensitive Telegram's client session files. --- Category: MALICIOUS - The campaign has clearly...

PT-2026-26970

Name of the Vulnerable Software and Affected Versions pygments versions up to 2.19.2 Description A security flaw exists in pygments. The issue resides within the AdlLexer function located in the pygments/lexers/archetype.py file, leading to inefficient regular expression complexity. This...