EBurst

EBurst 0.1 This script mainly provides account brute-forcing functionality for Exchange mail servers, integrating brute-force methods for existing mainstream interfaces. After searching around the internet for tools, I didn't find any particularly excellent ones, and they didn't quite match my ow...

EUVD-2026-102479

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2026-88755

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

CVE-2026-88755: Improper Neutralization of Special Elements used in an OS Command

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

EUVD-2026-102905

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

PT-2026-115623

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

CVE-2026-111321 TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2026-111321 TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2026-111321

The software TaskingAI versions up to and including 0.3.0 is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is the processing of an unvalidated OpenAPI servers[0].url within a user-defined action. Authenticated attackers possessing a project API key or console admin login...

CVE-2026-59951

A flaw was found in the Model Context Protocol MCP Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly...

Astra Linux – Vulnerability in curl

When the curl command is used to retrieve content using the Metalink feature, and a user name and password are used to download the Metalink XML file, those same credentials are then passed to each server from which the curl command will attempt to download or retrieve the content. This often...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a buffer overflow vulnerability when processing the DNS Server option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity, and/or...

CLEANSTART-2026-UU01575 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

CVE-2025-58181 affects multiple packages. SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. See references for individual vulnerability details...

CLEANSTART-2026-EM66119 SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be re...

CVE-2025-22869 affects multiple packages. SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. See references for...

CVE-2026-111321: Server-Side Request Forgery (SSRF)

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

DHCP Server Windows Code Execution

The vulnerability of DHCP servers for Windows operating systems is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

DHCP Server Windows Code Execution

The vulnerability of DHCP servers for Windows operating systems is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Issue Correction: Run dnf update libXrender --releasever 2023.12.20261012 or dnf update...

Important: libXrender

Issue Overview: A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients. CVE-2026-88807 Affected Packages: libXrender Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

HPESBNS05148 rev.1 - HPE NonStop Servers, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, memory corruption, Buffer Overflow, Stack Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. NONSTOP KERNEL T9050 - T9050L02^BBP, T9050L02^BBS EXPAND T9057 - T9057L02^AIG and earlier XDR Streams T0248 - T0248L01^AAD an...