Exploit for CVE-2026-15748

CVE-2026-15826, CVE-2026-15748 Donate Support the mainten...

CVE-2026-68519

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-75056

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible...

EUVD-2026-60255

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible...

CVE-2026-75056

JetBrains IntelliJ IDEA before 2026.2.1 is vulnerable to remote code execution via the Markdown export tool; a malicious Markdown document can trigger code execution during export. CVSS 7.8 (HIGH) — local attack vector, low complexity, no privileges required, user interaction needed. Upgrade to 2...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webflux - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webflux package for Root:Maven. Multiple fixed versions available...

CVE-2026-74798

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the databaseclean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView kernel/model/attributeview.go, which builds a filesystem path via filepath.Join withou...

EUVD-2026-60081

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the databaseclean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView kernel/model/attributeview.go, which builds a filesystem path via filepath.Join withou...

CVE-2026-74798 SiYuan kernel Path Traversal via database_clean MCP tool

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the databaseclean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView kernel/model/attributeview.go, which builds a filesystem path via filepath.Join withou...

CVE-2026-74798

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the databaseclean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView kernel/model/attributeview.go, which builds a filesystem path via filepath.Join withou...

BIT-PROXYSQL-2026-48774 ProxySQL MCP run_sql_readonly executes side-effecting MySQL multi-statements despite read-only contract

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 3.0.0 through 3.0.8, ProxySQL's GenAI/MCP runsqlreadonly tool violates its documented read-only contract for MySQL targets. The tool validates only the full input string with a substring blacklist and first-keyword...

Crypto <= 2.15 - Authentication Bypass

The Crypto plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.15. This is due a to limited arbitrary method call to 'cryptoconnectajaxprocess::login' function in the 'cryptoconnectajaxprocess' function. This makes it possible for unauthenticated...

UBUNTU-CVE-2026-72498

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

CVE-2026-19958

The CVE concerns iatsiuk pptr-mcp up to 0.2.7. Affected component is the execute Tool’s file src/vm-executor.ts, function executeCode, where manipulation enables code injection. Impact is exposed via a remote attack with public exploit availability; CVSS data indicates MEDIUM severity with networ...

PT-2026-73173

A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-72498

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

CVE-2026-72498 RDMA/bnxt_re: Avoid displaying the kernel pointer

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

CVE-2026-72498

The CVE-2026-72498 entry affects the Linux kernel's RDMA driver bnxt_re. The issue concerns the dumping of MR info with the rdma tool, where the mr_hwq (a kernel pointer) was exposed to end users. The vulnerability was resolved by avoiding display of the kernel pointer when dumping MR information...

CVE-2026-73678

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...