CVE-2026-19328

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...

CVE-2026-19328

Summary (CVE-2026-19328): The vulnerability affects aktsmm skill-ninja-mcp-server version 0.1.0, specifically the functions getInstalledSkills, installSkill, updateAgentsMd, and uninstallSkill in src/installer.ts. The issue is a local path traversal caused by manipulation of the workspacePath arg...

CVE-2026-19328 aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...

[SECURITY] [DSA 6422-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6422-1 [email protected] https://www.debian.org/security/ Andres Salomon August 08, 2026 https://www.debian.org/security/faq -...

Debian dsa-6422 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6422 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6422-1 [email protected] https://www.debian.org/securit...

CVE-2026-71945

CVE-2026-71945 affects D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108. The vulnerability is a command injection in the /boafrm/formLtefotaUpgradeFibocom interface, allowing a remote attacker to inject arbitrary commands into the fota_url field, resultin...

CVE-2026-71945

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71944 D-Link DWR-M961 Command Injection via /boafrm/formLtefotaUpgradeQuectel

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

EUVD-2026-54796

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71944

The CVE-2026-71944 vulnerability affects D-Link DWR-M961 devices with hardware version C1 and firmware older than 1.1.5_C1_202607071108. A command-injection flaw exists in the /boafrm/formLtefotaUpgradeQuectel interface, where an attacker can inject arbitrary commands through the fota_url field, ...

[SECURITY] [DSA 6421-1] pdns-recursor security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6421-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 08, 2026 https://www.debian.org/security/faq -...

[SECURITY] [DSA 6420-1] pdns security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6420-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 08, 2026 https://www.debian.org/security/faq -...

CVE-2026-19266

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...

CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...

CVE-2026-19266

Technical details about CVE-2026-19266 are not publicly available in the provided documents. Monitor for updates on affected components, versions, and remediation.

EUVD-2026-54767

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...

CVE-2026-19266 Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection

A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function execGitCommand of the file src/mcp/utils/gitUtils.ts of the component review-git-diff Endpoint. Executing a manipulation of the argument args can lead to command injection. Upgrading to version 1.9.1...

EulerOS 2.0 SP11 : httpd (EulerOS-SA-2026-3125)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are...

Debian dsa-6418 : thunderbird - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6418 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6418-1 [email protected] https://www.debian.org/securit...

CVE-2026-48026 lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...