CVE-2026-50143

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-50143

In @apify/actors-mcp-server versions before 0.10.11, getActorMCPServerURL() in src/mcp/actors.ts:44 naively concatenates a trusted base URL with an attacker-controlled webServerMcpPath, allowing an @ character to inject an arbitrary hostname. Node.js's WHATWG URL parser treats the prefix as useri...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

EUVD-2026-61136

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

PT-2026-78129

Name of the Vulnerable Software and Affected Versions Oracle Communications Unified Inventory Management versions 7.5.0 through 8.0.1 Description An unauthenticated attacker with network access via HTTP can compromise the system. This issue allows for unauthorized access, creation, deletion, or...

PT-2026-78236

Name of the Vulnerable Software and Affected Versions Streambert versions 2.5.0 through 2.5.9 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The wyzie-open-redeem IPC handler in index.js creates a partition:wyzie-redeem Electron...

CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

CGA-G972-9X54-3262

Bulletin has no description...

MINI-VHFR-F962-WF4F

Bulletin has no description...

MINI-9F3M-CP73-8MW3

Bulletin has no description...

CVE-2026-13700

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

MINI-M5MV-2VHW-4546

Bulletin has no description...

CVE-2026-15345

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-15345

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-15345 ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-59903

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

MINI-3PP4-V4HC-V6PH

Bulletin has no description...

MINI-JCQ7-2RJV-CMH9

Bulletin has no description...

Malicious code in tw-pkgprobe-7731 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...

DEBIAN-CVE-2026-74276

In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The method the driver uses to determine the size of the FIFO has a problem. What it currently does is this: It stops the SPI hardware and writes to the TX FIFO...