12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2044 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =0.1.0, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =1.0.0, =2.4.0 and more Source cves: CVE-2026-0621 Source advisory: OSV:GHSA-8R9Q-7V3J-JR4G...

CVE-2026-21635

An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite v1.5.2 and earlier to use WiFi AutoLink feature on a device that was only adopted via Ethernet...

CVE-2026-21635

An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite v1.5.2 and earlier to use WiFi AutoLink feature on a device that was only adopted via Ethernet...

Frappe Technologies Frappe 路径遍历漏洞

Frappe Technologies Frappe is a Python, Mariadb-based web development framework with integrated front-end pages from Frappe Technologies, India. A path traversal vulnerability exists in Frappe Technologies Frappe versions 14.99.5 and earlier and versions 15.0.0 through 15.80.1, which stems from a...

PT-2026-1350

Name of the Vulnerable Software and Affected Versions AIOHTTP versions 3.13.2 and below Description AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, has an issue in its parser logic. The parser allows non-ASCII decimals to be present in the Range header. This could...

PT-2026-30640

Name of the Vulnerable Software and Affected Versions Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans. Description A temporary denial-of-service DoS condition can occur when processing improperly formatted FILS Discovery Frames...

CVE-2026-21635: Improper Access Control

An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite v1.5.2 and earlier to use WiFi AutoLink feature on a device that was only adopted via Ethernet...

CVE-2025-64120 Nuvation Energy Multi-Stack Controller OS Command Injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Nuvation Energy Multi-Stack Controller MSC allows OS Command Injection.This issue affects Multi-Stack Controller MSC: from 2.3.8 before 2.5.1...

PT-2026-1136

Name of the Vulnerable Software and Affected Versions Nuvation Energy Multi-Stack Controller MSC versions 2.3.8 through 2.5.0 Description An authentication bypass issue exists in Nuvation Energy Multi-Stack Controller MSC. This allows unauthenticated attackers to gain full control. The issue...

Exploit for Improper Handling of Length Parameter Inconsistency in Mongodb

MongoBleed CVE-2025-14847 – Vulnerability Checker Systemhaus Sc...

CVE-2025-49355

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ikaes Accessibility Press ilogic-accessibility allows Stored XSS.This issue affects Accessibility Press: from n/a through = 1.0.2...

PT-2026-8195

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to out-of-range access of bc-domains within the imx8m blk ctrl remove function. This issue affects the pmdomain and imx8m-blk-ctrl components...

PT-2026-8185

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to shared memory shmem handling during file truncation. Specifically, an infinite loop can occur when truncating a large swap entry due to a rac...

PT-2026-26051

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Linux kernel perf event subsystem during ring buffer management. The issue occurs in the perf mmap function when a mmap setup fails and a concurrent mmap i...

PT-2026-26671

Name of the Vulnerable Software and Affected Versions GNU C library versions 2.34 through 2.43 Description The GNU C library’s gethostbyaddr and gethostbyaddr r functions, when used with a configured nsswitch.conf file specifying the library’s DNS backend, may return invalid DNS hostnames. This...

PT-2026-25059

Name of the Vulnerable Software and Affected Versions Vim versions 9.1.0011 through 9.2.0136 Description Vim, a command line text editor, has an issue where its NFA regex compiler can experience a segmentation fault. This occurs when the compiler encounters a character range containing a combinin...

EUVD-2025-206027

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players allows Retrieve Embedded Sensitive Data.This issue affects Post Video Players: from n/a through 1.163...

EUVD-2025-205960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ViitorCloud Technologies Pvt Ltd Add Featured Image Custom Link allows DOM-Based XSS.This issue affects Add Featured Image Custom Link: from n/a through 2.0.0...

SUSE CVE-2023-54229

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Because of what seems to be a typo, a 6Ghz-only phy for which the BDF does not allow the 7115Mhz channel will fail to register: WARNING: CPU: 2 PID: 1...

PT-2025-54350

Name of the Vulnerable Software and Affected Versions QuadLayers TikTok Feed versions through 4.6.4 Description A missing authorization issue exists in Quadlayers QuadLayers TikTok Feed due to incorrectly configured access control security levels. The issue allows exploitation of the access contr...