CVE-2026-97226: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initia...

CVE-2026-97368: Authorization Bypass Through User-Controlled Key

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97320: Server-Side Request Forgery (SSRF)

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side...

ROS-20260924-73-0053

The vulnerability of the isertwaitconn function in the drivers/infiniband/ulp/isert/ibisert.c module of the RTRS server and client kernel driver for the Linux operating system is related to state management errors. Exploiting this vulnerability could allow a remote attacker to compromise the...

CVE-2026-52001

The software geelen mcp-remote versions 0.1.18 through 0.1.38 contains a vulnerability that allows a remote attacker to obtain sensitive information . The root cause is located in the SSE transport eventSourceInit fetch wrapper within the file src/lib/utils.ts. No specific exploit details, in-the...

EUVD-2026-86019

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function...

CVE-2026-51997

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open functions...

CVE-2026-97366: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-97365: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly...

CVE-2026-97326: Server-Side Request Forgery (SSRF)

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes...

CVE-2026-97325: URL Redirection to Untrusted Site

A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the compone...

CVE-2026-97321: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-97233: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument filepath leads to cross site scripting. The attack can be launched remotely. Th...

CVE-2026-97232: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function getfilecontent/savefilecontent/movefiles/startstreaming of the file page.html. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been...

CVE-2026-97231: Missing Authentication for Critical Function

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public a...

CVE-2026-97225: Improper Control of Generation of Code

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from...

CVE-2026-97224: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. Th...

CVE-2026-52001: Exposure of Sensitive Information to an Unauthorized Actor

An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper " src/lib/utils.ts...

CVE-2026-97182: Improper Neutralization

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...

CVE-2026-97179: Exposure of Sensitive Information to an Unauthorized Actor

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of t...