CVE-2026-19244 HKUDS nanobot MCP enabledTools Scope mcp.py connect_mcp_servers access control

A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connectmcpservers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be...

CVE-2026-19244

The CVE affects HKUDS nanobot

CVE-2026-19243 HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...

EUVD-2026-54617

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...

CLSA-2026-1784769620 TuxCare security update for svelte (1 CVE)

TuxCare rebuilt svelte to address 1 CVE. Fixed in 0.3.0-tuxcare.2...

CLSA-2026-1784683085 TuxCare security update for jsonwebtoken (1 CVE)

TuxCare rebuilt jsonwebtoken to address 1 CVE. Fixed in 0.3.0-tuxcare.1...

CLSA-2026-1784682762 TuxCare security update for negotiator (1 CVE)

TuxCare rebuilt negotiator to address 1 CVE. Fixed in 0.3.0-tuxcare.1...

CLSA-2026-1776213252 TuxCare security update for svelte (6 CVEs)

TuxCare rebuilt svelte to address 6 CVEs. Fixed in 0.3.0-tuxcare.1...

CLSA-2026-1773274561 TuxCare security update for tunnel-agent (1 CVE)

TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.3.0-tuxcare.1...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the IPAllowlist function in the accesscontrol.go component. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending crafted requests remotely...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the IPAllowlist function in the accesscontrol.go component. An attacker can gain unauthorized access and potentially compromise confidentiality, integrity, and availability by sending crafted requests remotely...

Incorrect Authorization

Overview @cedar-policy/authorization-for-expressjs is a Middlewares to authorize expressJS applications with Cedar Affected versions of this package are vulnerable to Incorrect Authorization through improper matching of incoming requests using req.originalUrl. An attacker can gain unauthorized...

PYSEC-2026-572 weixin-python XML External Entity vulnerability

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/toxml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The name...

EUVD-2026-36769

An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input...

PT-2026-49315

Name of the Vulnerable Software and Affected Versions kanishka-linux Reminiscence version 0.3.0 Description An OS command injection allows attackers to execute arbitrary commands by supplying crafted input to the '/manage/features/media' endpoint. OS command injection is a flaw where an applicati...

CVE-2026-11529

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

CVE-2026-11529

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

CVE-2026-11529 designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

CVE-2026-11529 designcomputer mysql-mcp-server mysql URI server.py read_resource sql injection

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

EUVD-2026-35108

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...