ROS-20260924-73-0086

The vulnerability of the binderupdatepagerange function in the drivers/android/binderalloc.c module of the Linux operating system’s kernel is related to the use of memory after deallocation. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity,...

The vulnerability of the Workflows interface of the Kibana data visualization service, which allows a attacker to perform an SSRF attack

The vulnerability of the Workflows interface of the Kibana data visualization service is related to insufficient testing of queries on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

CVE-2026-96739: Improper Neutralization of Input During Web Page Generation

A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/uploadjson.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The explo...

EUVD-2026-86019

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function...

Linux Distros Unpatched Vulnerability : CVE-2026-97404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticate...

The vulnerability of the LibreNMS network monitoring system, related to deficiencies in the blocking procedures, allows attackers to perform cross-site scripting attacks.

The vulnerability of the LibreNMS network monitoring system is related to deficiencies in the blocking procedures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2026-96884: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-97365: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly...

CVE-2026-97226: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...

EUVD-2026-86018

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

CVE-2026-97224: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. Th...

PT-2026-97826

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.18 through 0.1.38 Description A flaw in the SSE Server-Sent Events transport eventSourceInit fetch wrapper located in src/lib/utils.ts allows a remote attacker to obtain sensitive information. Recommendations...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libevent (UTSA-2026-124537)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124537 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding...

ROS-20260924-73-0030

The vulnerability of the excludesuperstripes function in the fs/btrfs/block-group.c file of the btrfs file system in the Linux kernel is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

ROS-20260924-73-0076

The vulnerability of the hcievent component in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2026-96751: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

CVE-2026-97232: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function getfilecontent/savefilecontent/movefiles/startstreaming of the file page.html. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been...

CVE-2026-97233: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-96898: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument pathtype results in path traversal. It is possible to launch the atta...

CVE-2026-52001

The software geelen mcp-remote versions 0.1.18 through 0.1.38 contains a vulnerability that allows a remote attacker to obtain sensitive information . The root cause is located in the SSE transport eventSourceInit fetch wrapper within the file src/lib/utils.ts. No specific exploit details, in-the...