567604 matches found
CVE-2026-55539
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...
CVE-2025-71346
Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...
SealSecurity_Exam
SealSecurityExam Prototype Pollution ist eine JavaScript-Sicherheitslücke, die es einem Angreifer ermöglicht, beliebige Eigenschaften zu globalen Objektprototypen hinzuzufügen, die dann von benutzerdefinierten Objekten geerbt werden können. Eine Prototype-Pollution-Quelle ist jede...
CVE-2026-13217 NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...
EUVD-2026-65598
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...
CVE-2026-13217
The Zephyr RTOS OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c contains a NULL-pointer dereference in ocpp_process_server_msg(). When parsing the uid field of a CALLRESULT message, atoi(strtok_r(uid, "-", &tmp)) is called without checking whether strtok_r() returned NULL. A malicious or compromise...
CVE-2026-13217 NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...
CVE-2026-13217 NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
GHSA-8VH3-G2QG-2H2C nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
Summary The POST /webhooks/nextcloud endpoint has no authentication by default: WEBHOOKSECRET defaults to None and is never required by startup validation. When unset, the receiver accepts any unauthenticated POST. The userid is taken directly from the attacker-supplied payload and passed to...
GHSA-8CP3-QXJ6-PX34 utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Summary The utcp-http library = 1.1.3 unconditionally trusts the tokenUrl field embedded in remote OpenAPI security schemes. When a victim registers an attacker-controlled OpenAPI spec and invokes any generated OAuth2-protected tool, the library POSTs the victim's clientid and clientsecret to the...
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
Summary The utcp-http library = 1.1.3 unconditionally trusts the tokenUrl field embedded in remote OpenAPI security schemes. When a victim registers an attacker-controlled OpenAPI spec and invokes any generated OAuth2-protected tool, the library POSTs the victim's clientid and clientsecret to the...
GHSA-F5PJ-2738-996M mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist
mcp-shell at commit 17ac0eef5c9a5a42b8fb132d3d034973d55a5433 has two issues that together mean neither the default deploy path nor the recommended "secure mode" delivers the restriction they're marketed as providing. Filing these together because the two failure modes bracket the full intended...
mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlist
mcp-shell at commit 17ac0eef5c9a5a42b8fb132d3d034973d55a5433 has two issues that together mean neither the default deploy path nor the recommended "secure mode" delivers the restriction they're marketed as providing. Filing these together because the two failure modes bracket the full intended...
curl: Unbound cross-peer HTTP Digest challenge state
Summary When libcurl parses an HTTP Digest WWW-Authenticate challenge, it stores the realm, nonce, algorithm, and qop into the easy handle's state.digest — but does not bind that state to the peer that sent it. If the challenge is parsed but never used for output e.g. because Basic or Bearer was...
binary-exploitation-writeups
Binary Exploitation Writeups A comprehensive collection of bi...
CVE-2026-55371
A flaw was found in OpenEXR. A vulnerability in the exrattrsetbytes function allows an attacker to trigger a NULL pointer dereference by providing a positive hintlength with a NULL typehint. This can lead to a deterministic crash, resulting in a denial of service DoS, which makes the affected...
CVE-2026-55059
A flaw was found in OpenEXR, a widely used library for the EXR image format. A user processing a specially crafted image file could trigger a heap out-of-bounds write vulnerability in the SampleCountChannel::set function. This occurs due to an incorrect computation of the target Y coordinate,...
GHSA-MW6R-2HVM-4RP2 qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
Summary verifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explic...
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
Summary verifymathexpression in qwed-mcp v0.2.0 passes attacker-controlled strings directly to SymPy's parseexpr without restricting globaldict or validating the expression's AST. Because parseexpr internally calls eval and Python automatically injects the current module's builtins when no explic...