CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-47427

The vulnerability CVE-2026-47427 affects GitHub MCP Server. The CompletionsHandler in pkg/github/server.go dereferences params.Ref without nil-checking, so a completion/complete request with a missing or empty ref can trigger a nil pointer dereference, causing a Go runtime panic and an immediate ...

MINI-762H-H224-357P

Bulletin has no description...

CVE-2026-66921

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

MINI-8M36-G48C-5P3V

Bulletin has no description...

MINI-959P-M5PQ-H57F

Bulletin has no description...

MINI-759G-QXM7-33F4

Bulletin has no description...

MINI-WF2P-5GMC-JV5R

Bulletin has no description...

MINI-H363-653G-VFRV

Bulletin has no description...

MINI-R64F-48V3-8H9G

Bulletin has no description...

MINI-2C2P-V24W-VFWH

Bulletin has no description...

MINI-49WC-FHM8-F4VW

Bulletin has no description...

MINI-7RFW-V5W5-RX3J

Bulletin has no description...

MINI-FF5P-8HPG-P63W

Bulletin has no description...

MINI-C9JP-9G88-J7M5

Bulletin has no description...

EUVD-2026-49844

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

CVE-2026-66921

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

CVE-2026-13800

An inappropriate implementation flaw was found in the Updater component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=500108770...

BELL-CVE-2026-64512

Bulletin has no description...

CVE-2026-14926

The CVE describes a vulnerability in the FluentCart WordPress plugin prior to version 1.4.0 where several payment-method endpoints do not verify that a subscription belongs to the requesting customer. This IDOR-like flaw lets any authenticated user act on another user’s subscription—changing its ...