CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

EUVD-2026-65692

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

CVE-2026-55637

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2 , the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default address 127.0.0.1:8080 when MCP_AUTH_TOKEN is unset, without validating Host or Origin headers. A malicious websit...

CVE-2026-55637 genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

CVE-2026-75498

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75497

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c...

CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-75498

Webkul QloApps is susceptible to SQL injection due to missing validation of request parameters before a database query. A remote attacker with administrative privileges can inject a crafted SQL query via the bo_query parameter in the Address.php file. The flaw allows high impact on confidentialit...

CVE-2026-75498 Webkul QloApps SQL injection

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

CVE-2026-75498 Webkul QloApps SQL injection

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

EUVD-2026-65588

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'Address.php' file. Fixed in 123c97c...

EUVD-2026-65587

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c...

CVE-2026-75497

Webkul QloApps is susceptible to a SQL injection vulnerability caused by insufficient validation of request parameters before a database query. A remote, authenticated attacker with administrative privileges can exploit the bo_query parameter in the CustomerMessage.php file to execute crafted SQL...

CVE-2026-75497 Webkul QloApps SQL injection

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c...

CVE-2026-75497 Webkul QloApps SQL injection

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'boquery' parameter in the 'CustomerMessage.php' file. Fixed in 123c97c...

WordPress Newsletters plugin <= 4.17 - Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter vulnerability

Authenticated Author+ Arbitrary Modification via 'newslettersmailinglistsroles' POST Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Newsletters versions = 4.17...

WordPress Media Sweep plugin <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'fields' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Media Sweep – WordPress Media Cleaner versions = 1.1.3...

GHSA-Q27Q-98J4-9PFV qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

Summary The qwed package version 5.1.1 passes attacker-controlled input directly to SymPy's parseexpr function without a restricted namespace. Because parseexpr internally calls Python's eval, any authenticated tenant can execute arbitrary Python code inside the API server process. The attack...

EUVD-2026-65579

The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...