PT-2026-122137

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

CVE-2025-30047: Deserialization of Untrusted Data

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this...

CVE-2025-30046: Execution with Unnecessary Privileges

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes...

Node.js 26.x Security Release Check

A Bash tool identifies installed and running Node.js versions affected by the October 2026 security release, including a Brotli decoder out-of-bounds write that may permit remote code execution...

CVE-2026-115560

A flaw in PHP's session upload progress handling can lead to remote code execution when an application sets session.serializehandler to phpbinary or phpserialize in its configuration and switches it to php at runtime with iniset before calling sessionstart, while session.uploadprogress.enabled is...

PT-2026-135120

Security vulnerability affects the graphviz package. Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service application crash by loading a crafted file into the "lib/common/shapes...

CVE-2026-106764

An issue in @rog0x/mcp-git-tools version 1.0.1 allows a remote attacker to achieve arbitrary code execution . The vulnerability is triggered specifically through the resolveBaseBranch function. The CVSS 3.1 score for this issue is 7.5 (HIGH) , with a vector indicating that it requires high comple...

Security Advisory 0200

Security Advisory 0200 . CSAF PDF Date: October 23, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 23, 2026 | Initial release 1.1 | October 26, 2026 | Added CloudVision Portal to platforms not affected and added CSAF file to advisory. Description Arista Networks is providing this securi...

PT-2026-133235

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

Intranda goobi-viewer-core path traversal vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 24.03 up to but not including 26.05. This vulnerability arises because ExternalFilesDownloader.getFilename extracts the target filename from the Content-Disposition response header provided by the server and passes it...

Amazon AWS MCP Server input validation error vulnerability

The Amazon AWS MCP Server contains an input validation error vulnerability. This vulnerability stems from an incomplete whitelist of disallowed inputs within the Python code validator in the runscript tool, potentially allowing authenticated remote users to execute arbitrary code within their...

Amazon Linux Unpatched Vulnerability : CVE-2026-109619

The remote Amazon Linux host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be...

PT-2026-133246

An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function...

EUVD-2026-109096

An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions...

qt6-webengine -- multiple vulnerabilities

Qt qtwebengine-chromium repo reports: Backports for 80 security bugs in Chromium: CVE-2025-10201: Inappropriate implementation in Mojo CVE-2026-111497: Out-of-bounds write permits remote code execution in Brotli CVE-2026-112993: Use after free in Input CVE-2026-113012: Improper input validation i...

ROS-20261023-73-0145

The vulnerability in golang-github-prometheus relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

HPESBGN05174 rev.2 - Certain HPE Products Impacted by Multiple PHP Vulnerabilities (PHP2Shell)

Potential Security Impact: Remote: Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba ClearPass Policy Manager 6.11.0, 6.11.4, 6.12.0, 6.11.5, 6.11.6, 6.11.7, 6.12.1, 6.11.8, 6.12.2, 6.11.9, 6.12.3, 6.11.10, 6.12.4, 6.11.11, 6.12.5, 6.11.12, 6.12.6, 6.11.13,...

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running...

Linux Distros Unpatched Vulnerability : CVE-2026-111183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

ROS-20261023-73-0040

The vulnerability in Jenkins is related to insufficient control over the modification of dynamically defined object properties. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...