CVE-2026-48039 Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

EUVD-2026-54603

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

MAL-2026-13620 Malicious code in @catamania/front-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5 The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.userInfo username, process.cwd...

EUVD-2026-54525

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-19212

CVE-2026-19212 affects WonderTrader up to version 0.9.9. The vulnerability exists in the component TraderATP Cash Trade Conversion, specifically in the file src/Includes/WTSTradeDef.hpp where manipulating the argument m_offsetType can cause an uninitialized variable to be used. The issue can be e...

CVE-2026-19212 WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-19212 WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

CVE-2026-9169

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

OESA-2026-3250 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through...

OESA-2026-3249 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through...

PT-2026-69069

Name of the Vulnerable Software and Affected Versions WonderTrader versions prior to 0.9.9 Description A remote issue exists in the TraderATP Cash Trade Conversion component within the file src/Includes/WTSTradeDef.hpp. Manipulating the m offsetType argument can lead to the use of an uninitialize...

CVE-2026-9169: Uncontrolled Search Path Element

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

PT-2026-68888

Name of the Vulnerable Software and Affected Versions LUCID Vision Labs Arena SDK version 1.0.80.49 Description DLL Search Order Hijacking on Windows allows a local attacker to execute arbitrary code with the privileges of the application. This occurs when the SDK traverses directories listed in...

CVE-2026-19212: Use of Uninitialized Variable

A vulnerability was determined in WonderTrader up to 0.9.9. This impacts an unknown function of the file src/Includes/WTSTradeDef.hpp of the component TraderATP Cash Trade Conversion. Executing a manipulation of the argument moffsetType can lead to use of uninitialized variable. The attack can be...

CVE-2026-48097: Improper Neutralization of Special Elements used in an OS Command

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of shell=True with commands that rely on executable resolution through the PATH environment variable...

PT-2026-69113

Name of the Vulnerable Software and Affected Versions NexTor IP Changer versions prior to 2.0.0 Description NexTor IP Changer is a command-line tool used to periodically rotate a user's IP address via the Tor network. The software contains a command execution flaw caused by the unsafe use of...

CVE-2026-18501

The CVE concerns the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress. It is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69, caused by insufficient input sanitizati...

CVE-2026-64576

A flaw was found in the Linux kernel. During nexthop resolution, an uninitialized variable is used if a memory allocation fails. This can lead to the system attempting to access uninitialized stack memory, causing a general protection fault and a kernel panic. This vulnerability results in a Deni...

EUVD-2026-53659

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.1.1 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...