CVE-2020-25498

CVE-2020-25498: Beetel 777VR1 라우터의 CSRF를 통한 저장형 XSS 취약점 설명 취약한 엔드포인트는 서버 측 입력 검증이 없으며 악성 스크립트 주입에 대한 클라이언트 측 필터링이 부족한 것으로 확인되었습니다. 공격자는 이 취약점을 사용하여 엔드포인트에 악성 스크립트를 주입할 수 있으며, 사용자가 해당 엔드포인트를 열 때마다 스크립트가 활성화됩니다. 공격자는 POST 요청 페이로드가 포함된 악성 URL을 전송하여 CSRF를 통해 관리자 모듈에서 XSS를 실행하고, 최종적으로 장치와 네트워크를 장악할 수...

CVE-2026-23744-MCPJAM-RCE-exploit

CVE-2026-23744-MCPJAM-RCE-exploit 이 Python 개념 증명PoC은 대상 애플리케이션에 노출된 취약한 MCPModel Context Protocol 서비스를 대상으로 합니다. 이 취약점으로 인해 공격자는 /api/mcp/connect 엔드포인트에 임의의 서버 구성 매개변수를 공급할 수 있습니다. 영향을 받는 엔드포인트 POST /api/mcp/connect 사용된 도구 및 기술 Python 3 requests 라이브러리 HTTP/JSON API 통신 MCP 서비스 인터페이스 실행 의존성 설치: pip...

CVE-2026-91932 Flowise before 3.1.4 Remote Code Execution via cwd Parameter

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working...

CVE-2026-57128 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

CVE-2026-57128 PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/server.py does not consult ServerConfig.authtoken before handling /publish, /events, or /info requests. A network client that can reach the server can broadcast...

EUVD-2026-63480

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-mysql, spark-operator, nova, render-template, aws-otel-collector, envconsul, helm-operator, regclient, nri-consul, cis-operator, docker-cli, wgcf, kapp-controller, kubernetes-dashboard-auth, ko, kube-logging-operator, nri-f5, opentofu, kube-bench, witness,...

CVE-2026-18703

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 Educational PoC Educational use only. Th...

CVE-2026-19341

CVE-2026-19341 affects UTT HiPER 1200GW (up to version 2.5.3-170306). The vulnerability targets the strcpy usage in /goform/pptpSrvGlobalConfig, where manipulation of the EncryptionMode argument causes a stack-based buffer overflow. This can be triggered remotely and is publicly disclosed; exploi...

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

CVE-2026-58080

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...

PT-2026-61712

Name of the Vulnerable Software and Affected Versions Tenda TX9 version V22.03.02.20 Description A stack overflow occurs in the sub 42EA38 function within the /goform/SetVirtualServerCfg file. A stack overflow is a condition where a program writes more data to a stack-allocated buffer than it can...

CVE-2026-45309

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

Improper Handling of Case Sensitivity

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the .htaccess process. An attacker can gain unauthorized access to sensitive configuration files by...

PYSEC-2026-2599 LiteLLM: Authenticated command execution via MCP stdio test endpoints

Impact Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...

PT-2026-59133

Impact An uncontrolled-resource-consumption memory exhaustion denial-of-service vulnerability CWE-400 / CWE-789. A client with push access could push a tiny crafted thin pack 174 bytes whose delta header declares a huge dest size. When dulwich ingested it via add thin pack / apply delta, it would...

CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...

litellm passes untrusted data to `eval` function without sanitization

A remote code execution RCE vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.getsecret method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function...

PYSEC-2026-1542 litellm passes untrusted data to `eval` function without sanitization

A remote code execution RCE vulnerability exists in the berriai/litellm project due to improper control of the generation of code when using the eval function unsafely in the litellm.getsecret method. Specifically, when the server utilizes Google KMS, untrusted data is passed to the eval function...