CVE-2026-74858

In jae-jae fetcher-mcp up to 0.3.9, the fetch_url/fetch_urls functions in the URL Validation component fail to validate the AWS metadata endpoint /latest/meta-data/iam/security-credentials/, enabling remote SSRF. CVSS 6.3 (Medium); no patch is available yet, and the project has not responded to t...

CVE-2026-74858 jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery

A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetchurl/fetchurls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack...

CVE-2026-74858

A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetchurl/fetchurls of the file /latest/meta-data/iam/security-credentials/ of the component URL Validation. Such manipulation leads to server-side request forgery. It is possible to launch the attack...

MINI-M5X7-847R-99W2

Bulletin has no description...

CVE-2026-70412

Dell iDRAC9 (pre-7.20.30.50) and iDRAC10 (pre-1.20.60.50) expose remanent data after memory erase, enabling a low-privileged remote attacker to disclose information. CVSS 3.5 (LOW) requires low privileges and user interaction. No exploit code or in-the-wild exploitation is documented; apply Dell ...

CVE-2026-70412

Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-74868

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation PublishServiceTransport.RoundTrip in kernel/server/proxy/publish.go. The Publish Service runs on a separate, unauthenticated-by-default listener default TCP port 6808 and...

CVE-2026-74843

Wavlink WN531P3 and WN535M1 routers (firmware V250922) are vulnerable to a remote stack-based buffer overflow in the strcpy call of /etc/lighttpd/www/cgi-bin/export_pingortace.cgi, triggered by manipulating the HTTP_COOKIE argument. CVSS 10.0 (critical); a proof-of-concept exploit is publicly ava...

CVE-2026-74843

A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/exportpingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTPCOOKIE can lead to...

EUVD-2026-60119

A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/exportpingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTPCOOKIE can lead to...

CVE-2026-74843 Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow

A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/exportpingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTPCOOKIE can lead to...

CVE-2026-74868

SiYuan before 3.7.4 has an unthrottled brute-force flaw in PublishServiceTransport.RoundTrip() (kernel/server/proxy/publish.go), where the Publish Service (default TCP 6808) applies Basic Auth with no rate limiting, lockout, or backoff, letting unauthenticated remote attackers guess passwords aga...

RHSA-2026:55441 Red Hat Security Advisory: bind security update

Bulletin has no description...

389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser

A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure...

CVE-2026-19999

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys3DGSMDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The manipulati...

CVE-2026-20000

A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now publi...

EUVD-2026-60066

A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now publi...

CVE-2026-20000

A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now publi...

CVE-2026-20000 itsourcecode Hospital Management System viewprescriptionrecord.php sql injection

A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now publi...

CVE-2026-20000

The connected CVE details a SQL injection in itsourcecode Hospital Management System 1.0, impacting the /viewprescriptionrecord.php script via the delid parameter. The vulnerability arises from manipulating delid, allowing remote attacker input to affect database queries. Public exploitation is i...