GHSA-RQV2-M695-F8J4 MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

Summary The public catalogue UI served at GET / file internal/api/handlers/v0/uiindex.html is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go validateWebsiteURL only checks that the...

MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

Summary The public catalogue UI served at GET / file internal/api/handlers/v0/uiindex.html is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go validateWebsiteURL only checks that the...

CVE-2026-43472

creationtimestamp| type| source ---|---|--- 2026-05-08 17:08:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116540052992107234 2026-05-09 16:06:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116545473383071089 2026-08-03 07:13:46+00:00| seen|...

CVE-2026-41886

creationtimestamp| type| source ---|---|--- 2026-05-08 17:07:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mle7qhnbjg2w...

CLSA-2026-1778254382 buildah: Fix of CVE-2026-25679

rebuild on tuxcare9.6esu with newer golang version 1.25.7-1.el96.tuxcare.els2 to fix the following CVE: - CVE-2026-25679: fix insufficient validation of host/authority component in url.Parse - split golang BuildRequires by .el96 so each ELS platform pulls its own fixed golang version el96 -...

CVE-2026-43346

creationtimestamp| type| source ---|---|--- 2026-05-08 17:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mle7mpnjyz2p...

CVE-2026-41885

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath /...

CVE-2026-43967

creationtimestamp| type| source ---|---|--- 2026-05-08 16:15:20+00:00| published-proof-of-concept| https://github.com/absinthe-graphql/absinthe/security/advisories/GHSA-9mhv-8h52-q7q2 2026-05-08 18:41:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleeymqjoz2p...

CVE-2026-42793

creationtimestamp| type| source ---|---|--- 2026-05-08 16:15:00+00:00| published-proof-of-concept| https://github.com/absinthe-graphql/absinthe/security/advisories/GHSA-qf4g-9fqq-mmm7 2026-05-08 19:03:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlegaauzd22q...

CVE-2026-34354

creationtimestamp| type| source ---|---|--- 2026-05-08 16:04:56+00:00| seen| https://bsky.app/profile/pigondrugs.bsky.social/post/3mle4bha7b72e 2026-05-09 19:54:24+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3mlgzkpanzm2z...

CVE-2026-42030

Technical details about CVE-2026-42030 are not publicly provided in the supplied documents. Monitor for updates from MapServer advisories and the CVE entry.

CVE-2026-41885 Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath /...

CVE-2026-41885 Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath /...

CVE-2026-41885 Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath /...

EUVD-2026-28795

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath /...

CVE-2025-66467

creationtimestamp| type| source ---|---|--- 2026-05-08 15:25:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mle22beobj2k 2026-05-09 04:56:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlfhec6qbh2j 2026-05-09 19:54:58+00:00| seen|...

CVE-2026-44129

creationtimestamp| type| source ---|---|--- 2026-05-08 15:20:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mldzrc5n2s2t...

CVE-2026-44128

creationtimestamp| type| source ---|---|--- 2026-05-08 15:05:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mldywbv4f42e...

CVE-2026-41487 Langfuse: Improper role-based-access control in Langfuse LLM connection management allowed users of role “member” to retrieve stored LLM provider API keys

Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw in the LLM connection update flow. An authenticated, low-privileged user of role “member” in a project could request the update of an...

CVE-2026-41487

CVE-2026-41487 affects Langfuse (open source LLM engineering platform). From version 3.68.0 up to before 3.167.0, a role-based access control flaw in the LLM connection update flow allowed an authenticated, low-privilege user with the role “member” in a project to request updating an LLM connecti...