PT-2026-69050

Name of the Vulnerable Software and Affected Versions WonderTrader versions prior to 1.0.0 Description A remote attack is possible through the manipulation of the FID JYLB argument within the TraderDD::queryTrades function located in the src/TraderDD/TraderDD.cpp file. This action results in the...

PT-2026-69043

Name of the Vulnerable Software and Affected Versions libiec61850 versions prior to 1.6.2 Description A heap-based buffer overflow exists in the ASDU Element Handler component within the SVReceiver stopThreadless function located in the src/sampled values/sv subscriber.c file. This issue allows a...

CVE-2026-19206: Heap-based Buffer Overflow

A security flaw has been discovered in MZ Automation libiec61850 up to 1.6.1. This affects the function SVReceiverstopThreadless of the file src/sampledvalues/svsubscriber.c of the component ASDU Element Handler. Performing a manipulation results in heap-based buffer overflow. The attack must be...

CVE-2026-19212: Use of Uninitialized Variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-19054 Lspace-io lspace-server Repositories File API repository.ts deleteFile path traversal

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

CVE-2026-19044 LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component createscene/addnode. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. The...

CVE-2026-19039 Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...

EUVD-2026-53700

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The...

CVE-2026-19047: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...

CVE-2026-70636: Missing Authorization

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

CVE-2026-19011: External Control of File Name or Path

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The projec...

CVE-2026-19046: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the component ludusenvironmentguidessearch. Such manipulation of the argument guidename leads to path traversal...

CVE-2026-19045: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in NocteDefensor LudusMCP up to 1.0.24. The affected element is the function SecretDialog.showSecretDialog of the file src/utils/secretDialog.ts of the component getcredentialfromuser. This manipulation of the argument Description causes command injection. It is...

PT-2026-68379

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.13 Description A remote issue exists in the run command Handler component within the PermissionManager.checkShellCommand function located in the src/capabilities/permissions.ts file...

PT-2026-68664

Name of the Vulnerable Software and Affected Versions lspace-server versions up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71 Description An issue in the Repositories File API component within the file src/core/repository.ts allows for path traversal—a method used to access files and directories th...

CVE-2026-19054: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

PT-2026-68484

Name of the Vulnerable Software and Affected Versions MonomythDevelopment la-forge-mcp versions prior to 1.1.1 Description A path traversal issue exists in the screenshotElement function within the src/index.ts file of the screenshot element Tool. This flaw allows a remote attacker to manipulate...

PT-2026-68500

A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create scene/add node. This manipulation of the argument projectPath causes command injection. The attack needs to be launched locally. T...

PT-2026-68615

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP versions prior to 1.0.25 Description A path traversal issue exists within the ludus environment guides search component, specifically in a function located in the src/tools/ludusEnvironmentGuidesSearch.ts file. This occu...

PT-2026-68494

Name of the Vulnerable Software and Affected Versions MissionSquad mcp-api versions prior to 1.11.10 Description A remote flaw exists in a function within the src/services/dcrClients.ts file. This issue allows for server-side request forgery, a technique where an attacker induces the server to ma...