CVE-2026-47769

APIFold is the affected software. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, its OpenAPI/Swagger-based MCP server could accept arbitrary unauthenticated JSON on the /webhooks/:serverSlug/:eventName endpoint, storing payloads in Redis and webhook_events without signature checks or a...

SUSE CVE-2026-65315

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

CVE-2026-47752 Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...

CVE-2026-47752

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection SSTI in the notification template feature. The titletemplate and bodytemplate fields are rendered using an unsandboxed jinja2.Environment, allowing...

CVE-2026-44909

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...

CVE-2026-65695 Office-Word-MCP-Server 1.1.11 Path Traversal via document tools

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...

CVE-2026-65695 Office-Word-MCP-Server 1.1.11 Path Traversal via document tools

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...

CVE-2026-48536

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

CVE-2026-48534

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data...

EUVD-2026-48295

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload ...

CVE-2026-48534 GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

CVE-2026-48534 GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

CVE-2026-48534

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

EUVD-2026-48293

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...

Server-side Request Forgery (SSRF)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the webService process. An attacker can access internal services and exfiltrate sensitive da...

Not Failing Securely ('Failing Open')

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the auth process. An attacker can gain unauthorized access to protected resources by triggering a server-side configuration error that causes the auth...

GHSA-8FPG-XM3F-6CX3 Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Impact next-auth Auth.js v5 applications that gate access by checking only for the existence of the auth object — the pattern shown in the official session management / protecting resources guide — are affected. When the Auth.js configuration produces a server-side error, the auth object exposed ...