CVE-2026-18968

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

CVE-2026-18968 ttttonyhe OBlog tags.php cross site scripting

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

CVE-2026-18968

CVE-2026-18968 affects ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. The vulnerability is in processing of the file /tags.php where manipulation of the day argument enables cross site scripting. The attack could be performed remotely, and the exploit has been publicly disclosed....

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531

CVE-2026-67531 affects FrontMCP before 1.5.7. The sandboxed codecall:execute tool could leak live host Zod schema instances to scripts via getTool, and due to Zod v4 _zod being non-configurable/non-writable, the ECMAScript Proxy invariant returned the raw host object. This allowed a script to rea...

EUVD-2026-53684

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

vulnerable-by-design-rmf-hardening

vulnerable-by-design-rmf-hardening so i built a helpdesk tick...

CVE-2026-71320

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /nuxtisland/ props into a dynamic component when vue.runtimeCompiler: true is enabled, causing template execution in the Nitro process. This issue is fixe...

DEBIAN-CVE-2026-67864

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component...

CVE-2026-67864

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component...

CVE-2025-63823

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...

CVE-2026-67865

S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service...

MAL-2026-13380 Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

Malicious code in uncrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...

Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Summary There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged...

GHSA-42CJ-M3VJ-89WV Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass

Summary There is a medium-severity cross-provider reference vulnerability in Traefik's Kubernetes CRD provider. The crossProviderNamespaces allowlist is enforced for HTTP serversTransport references but was not enforced for IngressRouteTCP service serversTransport references. A low-privileged...

GHSA-QQ9Q-X9W4-CHHJ Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion

Summary There is a medium-severity namespace-confusion vulnerability in Traefik's Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules.backendRefs.filters.extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author...