304527 matches found
EUVD-2026-65962
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process...
CVE-2026-77585 Improper Validation of SSH Target in Okta Privileged Access Client
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process...
CVE-2026-77585 Improper Validation of SSH Target in Okta Privileged Access Client
The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target. As a result, the value may be interpreted as a command-line option by the underlying SSH process...
CVE-2026-77585
CVE-2026-77585 affects the Okta Privileged Access client , which fails to reject a leading hyphen in the username portion of an SSH target string. Because the value can be interpreted as a command-line option by the underlying SSH process, this constitutes an improper validation issue. Per the as...
Important: Red Hat Security Advisory: sg3_utils security update
An update for sg3utils is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
Important: Red Hat Security Advisory: sg3_utils security update
An update for sg3utils is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
Malicious code in minecraft-ytreceiver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...
MAL-2026-14516 Malicious code in minecraft-ytreceiver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad998d7ff924f18f57116d8dd586342fd060d8fb1459d94c0a911589bc2e3686 The package's module polls a hardcoded Telegram bot api.telegram.org, bot id 8871201315 for commands scoped to a specific chat and topic. On matching...
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...
GHSA-HVFH-5MJ3-5F3J Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...
GHSA-W3FX-MC44-MF6J Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...
CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...
CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...
EUVD-2026-65737
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...
CVE-2026-45018
Chainlit (Python framework for conversational AI applications) is vulnerable to command injection via its MCP stdio transport in versions 2.4.0rc0 through 2.12.0 . When features.mcp.enabled is set to true, the POST /mcp endpoint is exposed without authentication . The validate_mcp_command() funct...
CVE-2026-45018 Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code execution
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...
