ROOT-APP-NPM-CVE-2025-56200 CVE-2025-56200 in @rootio/validator - Patched by Root

Root has patched CVE-2025-56200 in the @rootio/validator package for Root:npm. Multiple fixed versions available...

CVE-2026-15305 TYPO3 CMS - Unrestricted File Upload in Form Framework

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties...

CVE-2026-15305

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties...

PT-2026-58011

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 14.2.0 through 14.3.5 Description Users can upload files with arbitrary MIME types to forms utilizing FileUpload or ImageUpload elements that have allowedMimeTypes configured. This occurs because the MimeTypeValidator is...

mcp-validator (0.1.1) potentially affected by CVE-2026-31245 via mem0ai (0.1.113)

mem0ai PYPI version 0.1.113 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - mcp-validator 0.1.1 Source cves: CVE-2026-31245 Source advisory: OSV:PYSEC-2026-2633...

mcp-validator (0.1.1) potentially affected by CVE-2026-31241 via mem0ai (0.1.113)

mem0ai PYPI version 0.1.113 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - mcp-validator 0.1.1 Source cves: CVE-2026-31241 Source advisory: OSV:PYSEC-2026-2634...

mcp-validator (0.1.1) potentially affected by CVE-2026-31240 via mem0ai (0.1.113)

mem0ai PYPI version 0.1.113 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - mcp-validator 0.1.1 Source cves: CVE-2026-31240 Source advisory: OSV:PYSEC-2026-2635...

mcp-validator (0.1.1) potentially affected by CVE-2026-7597 via mem0ai (0.1.113)

mem0ai PYPI version 0.1.113 is affected by a known vulnerability. The following packages have a transitive dependency on mem0ai and may be impacted: - mcp-validator 0.1.1 Source cves: CVE-2026-7597 Source advisory: OSV:PYSEC-2026-2636...

codemie-tools (>=0.0.405, <=0.1.13.7), knowai (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2026-26013 via langchain-core (0.3.67)

langchain-core PYPI version 0.3.67 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - codemie-tools =0.0.405, =0.3.0, =0.6.0 - mcp-validator 0.1.1 - trim-sdk 0.2.2 Source cves: CVE-2026-26013 Source advisory:...

CVE-2026-15528

A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicadmcp/utils/pathvalidator.py. Performing a manipulation of the argument projectpath/schematicpath results in protection mechanism failure. Attacking locally is a requirement...

CVE-2026-15528 lamaalrajih kicad-mcp path_validator.py protection mechanism

A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicadmcp/utils/pathvalidator.py. Performing a manipulation of the argument projectpath/schematicpath results in protection mechanism failure. Attacking locally is a requirement...

CVE-2026-15528 lamaalrajih kicad-mcp path_validator.py protection mechanism

A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicadmcp/utils/pathvalidator.py. Performing a manipulation of the argument projectpath/schematicpath results in protection mechanism failure. Attacking locally is a requirement...

CVE-2026-15528

CVE-2026-15528 affects lamaalrajih/kicad-mcp up to 3.3.1. The vulnerability is in kicad_mcp/utils/path_validator.py where manipulating the arguments project_path or schematic_path causes a protection mechanism failure. Local exploitation is required, and the exploit has been made public. The proj...

CVE-2026-15528

A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown processing of the file kicadmcp/utils/pathvalidator.py. Performing a manipulation of the argument projectpath/schematicpath results in protection mechanism failure. Attacking locally is a requirement...

PT-2026-59653

Summary The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. The blocklist implemented in PluginSecurity.validate plugin code is incomplete and can be bypassed using several Python constructs that are not checked. An...

PT-2026-57615

Name of the Vulnerable Software and Affected Versions lamaalrajih kicad-mcp versions prior to 3.3.2 Description A failure in the protection mechanism occurs during the processing of the file kicad mcp/utils/path validator.py. This issue can be triggered by manipulating the project path or schemat...

BIT-DJANGO-2026-53878 Header injection possibility since DomainNameValidator accepted newlines in input

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. DomainNameValidator does not prohibit newlines in domain names unless used via a form field, since CharField strips newlines. If an application uses values with newlines in an HTTP response, header injection can occur. Djan...

SUSE CVE-2026-59887

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and .match can be invoked at every mailto: occurrence and scan the remaining input through srcemailname in lib/re.mjs, causing On^2 CPU consumption on crafted user text...

CVE-2026-53878

A flaw was found in Django. django.core.validators.DomainNameValidator accepted newline characters in domain name input. When applications use this validator outside Django form fields and include the validated value in HTTP response headers, a remote attacker could perform HTTP header injection...

Malicious code in validator-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a95b09ecd097cf7db1496950d26195169adb7ad2d8065a3458771389094be4 Package name validator-string impersonates the widely-used npm package validator and copies its README, homepage, and API surface. package.json...