2947 matches found
ROOT-APP-NPM-CVE-2025-69873 CVE-2025-69873 in @rootio/ajv - Patched by Root
Root has patched CVE-2025-69873 in the @rootio/ajv package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-56761 CVE-2026-56761 in @rootio/hono - Patched by Root
Root has patched CVE-2026-56761 in the @rootio/hono package for Root:npm. Multiple fixed versions available...
EUVD-2026-49049
A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer of the file src/modules/self-mod/request.ts of the component addmcpserver. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been...
CVE-2026-64419
CVE-2026-64419 is a Linux kernel vulnerability in the mm/shrinker subsystem. The function shrinker_debugfs_count_show() invokes a shrinker's ->count_objects() callback while holding an RCU read-side lock . The zswap shrinker's callback flushes memcg statistics via css_rstat_flush(), which may ...
SUSE CVE-2026-64231
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...
CVE-2026-47708
CVE-2026-47708 (MCP-for-Stata) : Multiple sources describe a command-injection vulnerability in the log_file_name parameter used by the stata_do/stata-mcp wrapper. Prior to version 1.17.3, log_file_name is interpolated into a Stata command string without sanitization; the GuardValidator does not ...
hplip security update
An update is available for hplip. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The hplip packages contain the Hewlett-Packard Linux Imaging and Printing...
ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root
Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...
PYSEC-2026-2789 Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule
Summary A memory-safety vulnerability in Open Babel's GAMESS output parser caused a use-after-free when reading a crafted input file. Details The flaw was in GAMESSOutputFormat::ReadMolecule. A malformed input caused the parser to dereference a stale pointer after the underlying object had been...
PYSEC-2026-2687 OctoPrint has possible file exfiltration via query parameters on upload endpoints
Impact OctoPrint versions up until and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 contain a vulnerability that allows an attacker with the FILEUPLOAD permission to exfiltrate files from the host that OctoPrint has read access to, by moving them into the upload folder where they then can be...
PYSEC-2026-3046 RAGAS has SSRF via Multi-Modal Faithfulness Collections Module
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function tryprocesslocalfile/tryprocessurl of the file src/ragas/metrics/collections/multimodalfaithfulness/util.py of the component Collections Module. Performing a manipulation of the argument...
CVE-2026-55604
DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global SessionStore accepts caller-supplied sessionid values without binding them to any authenticated principal or transport session. An attacker can enumerate active session I...
PYSEC-2026-1313 docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage
Impact A PyYAML-related Remote Code Execution RCE vulnerability, namely CVE-2020-14343, is exposed in docling-core =2.21.0, 2.48.4 and, specifically only if the application uses pyyaml 5.4 and invokes doclingcore.types.doc.DoclingDocument.loadfromyaml passing it untrusted YAML data. Patches The...
RHSA-2026:35896 Red Hat Security Advisory: kernel security update
Bulletin has no description...
PT-2026-56237
Name of the Vulnerable Software and Affected Versions Chevereto versions 3.7.5 through 4.5.3 Description An issue exists in the self-hosted media-sharing platform where the /json AJAX listing endpoint fails to enforce private profile restrictions. While the profile HTML route /username correctly...
UBUNTU-CVE-2026-14760
A weakness has been identified in radareorg radare2 up to 6.1.6. Impacted is the function rcoreseekarchbits of the file libr/core/disasm.c of the component regprofile Handler. Executing a manipulation can lead to use after free. The attack requires local access. The exploit has been made availabl...
GHSA-VJJX-RFW4-RMFC SurrealDB: Graph traversal bypasses table SELECT permissions
An authenticated record or scope user could read records on any table reachable through a graph edge or REFERENCES TO back-reference, regardless of that table's PERMISSIONS FOR select clause. Traversing SELECT FROM source-edge-target returned full documents from target even when target was define...
EulerOS 2.0 SP15 : openjpeg2 (EulerOS-SA-2026-2495)
According to the versions of the openjpeg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library...