CVE-2026-19279

A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function loadpdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was inform...

CVE-2026-68082

CVE-2026-68082: In the Linux kernel’s libceph code, decode_lockers() uses two unsafe bare decodes (ceph_decode_32(p) and ceph_decode_8(p)) that can read past the validated buffer, enabling a malicious OSD to influence the locker type and trigger slab-out-of-bounds reads. The fix replaces these wi...

CVE-2026-68081

The CVE concerns KVM nVMX in the Linux kernel. The root cause is an open coded path that neglects to put vmcs12 pages when a nested VM-Enter fails due to invalid guest state during VMLAUNCH/VMRESUME, causing leaks of pinned pages and/or mappings if L1 retries. The issue is resolved in the Linux k...

CVE-2026-19270

Hulupeep mcp-ui-probe up to 0.2.0 contains a local path-traversal vulnerability in Journey/Usage’s JourneyStorage.ts. The affected functions—get_journey, delete_journey, analyze_journey, and usage_stats—manipulate journeyId/filename to access unintended paths. The issue requires local access; no ...

CVE-2026-19268

Summary of CVE-2026-19268 (abdullah1854 MCPGateway) : The vulnerability affects the MCPGateway project up to commit 549f494a9e363f40530149de324b8097de424230, specifically the Claude Usage Range Endpoint. The issue is in the function getUsageByDateRange within src/services/claude-usage.ts, where a...

CVE-2026-19266

Technical details about CVE-2026-19266 are not publicly available in the provided documents. Monitor for updates on affected components, versions, and remediation.

CVE-2026-19263

INQUIRELAB mcp-bridge-api (up to b30a82aa1d1d1139e0de846c41c8aadee6e06114), specifically the Servers Endpoint component mcp-bridge.js, is affected by a command injection vulnerability triggered by manipulating the command/args argument. The issue allows remote initiation. The product uses a rolli...

CVE-2026-14526

The AI Copilot – Content Generator plugin for WordPress is affected by an authorization bypass vulnerability in all versions up to and including 1.5.6. The issue arises because the plugin does not properly verify a user’s authorization to perform certain actions, enabling unauthenticated attacker...

CVE-2026-16955

The CVE affects the AI Engine WordPress plugin, prior to version 3.6.6. The root cause is that the plugin does not confine a caller-supplied file path before reading it and forwarding the contents to an external service. This allows a subscriber-level user to read arbitrary files from the server ...

CVE-2026-16953

The CVE concerns the AI Engine WordPress plugin (before 3.6.4). The issue is that the plugin does not verify ownership of a guest’s uploaded chatbot files before deletion, authorising a delete action solely via a client-supplied session cookie. An unauthenticated attacker who obtains a victim’s s...

CVE-2026-16948

The CVE concerns the Solace Extra WordPress plugin prior to version 1.6.1. The issue stems from missing capability checks in several AJAX actions and exposure of the nonce protecting them on admin pages, which low-privilege users (down to the Subscriber role) can access. This allows modification ...

CVE-2026-16594

The CVE affects the WP Directory Kit WordPress plugin prior to version 1.5.5. The root cause is missing authorization and nonce checks on an authenticated AJAX action, which allows any authenticated user (e.g., a Subscriber) to disclose settings from the plugin’s before-1.5.5 state, including sen...

CVE-2026-16589

WP Directory Kit

CVE-2026-16590

WP Directory Kit prior to version 1.5.5 has an authorization/nonce check flaw in an authenticated AJAX action, enabling any authenticated user (e.g., Subscriber) to retrieve other users’ stored contact messages and related user data. Root cause: missing access control on the AJAX endpoint. Impact...

CVE-2026-16595

The WP Directory Kit WordPress plugin, before version 1.5.5, fails to perform authorization or nonce checks on one authenticated AJAX action. This allows any authenticated user (e.g., a Subscriber) to disclose other users’ data, including the site’s user list and unpublished listings. The entry s...

CVE-2026-16608

The CVE covers the Download Monitor WordPress plugin, prior to version 5.2.6, where an unauthenticated AJAX endpoint used for download-logging lacks authorization checks and leaks its nonce to unauthenticated visitors. This enables unauthenticated users to inject arbitrary download log entries, i...

CVE-2026-16574

CVE-2026-16574 affects the Dokan WordPress plugin (AI Powered WooCommerce Multivendor Marketplace Solution) prior to version 5.0.11. The root cause is a missing verification that a downloadable product belongs to the requesting vendor before granting download permissions via an order REST endpoin...

CVE-2026-16535

The CVE-2026-16535 entry concerns the Link Library WordPress plugin (versions before 7.9.4). The vulnerability arises because a parameter is not sanitized/escaped before being reflected in a response, enabling unauthenticated attackers to perform Reflected Cross-Site Scripting against users who a...

CVE-2026-16559

The YMC Filter WordPress plugin (pre-3.12.9) fails to sanitize SVG uploads via its icon upload feature, allowing low-privilege users (Author role+) to upload SVGs containing JavaScript that executes in the site origin when viewed (Stored XSS). A fix is to update to version 3.12.9 or later; otherw...

CVE-2026-16562

CVE-2026-16562 – WP Statistics (WordPress) plugin before 14.16.10: the dashboard analytics AJAX handlers fail to perform a proper capability check, relying only on a nonce that is possessed by any authenticated user. This allows users with Subscriber-level access and higher to disclose visitor an...

CVE-2026-16558

The CVE concerns the YMC Filter WordPress plugin (versions before 3.12.8). The vulnerability arises because the plugin does not sanitize/escape a layout builder setting before rendering it on a public endpoint and does not verify object ownership when saving the setting. This allows users with th...

CVE-2026-16578

The CVE-2026-16578 entry concerns the WordPress plugin Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection (pre-1.4.0). The issue is a missing capability check on a REST API endpoint (2fa/app/users), allowing unauthenticated access to the full user list, including user...

CVE-2026-16282

The CVE describes a vulnerability in the Appointment Hour Booking WordPress plugin prior to version 1.5.88 where a missing validation of a client-supplied booking price against the server-side service price allows unauthenticated users to submit arbitrary final prices (including zero or negative)...

CVE-2026-16267

The Newsletters WordPress plugin, prior to version 4.16, does not restrict the classes allowed during unserialisation of a value submitted via a public form. This allows unauthenticated attackers to inject arbitrary PHP objects. Affected: Newsletters plugin

CVE-2026-16269

The Newsletters WordPress plugin (

CVE-2026-19259

The CVE concerns MZ Automation libiec61850 (up to 1.6.1). The vulnerability is in the MMS Protocol Workflow, specifically MmsMapping_varAccessSpecToObjectReference in src/iec61850/common/iec61850_common.c, where manipulation of GetNamedVariableListAttributesResponse.itemId causes a heap-based buf...

CVE-2026-18988

The CVE-2026-18988 entry concerns the Easy Accordion plugin for WordPress, affected in versions up to and including 3.1.8. The underlying issue is insufficient input sanitization and output escaping in accordion_header_renderer(), which emits attacker-supplied tag names using esc_attr() in an HTM...

CVE-2026-13505

CVE-2026-13505 concerns Bouncy Castle for Java FIPS (BC-FJA). The issue: sensitive key material held by AES/DESede engines, SP 800-90A DRBGs, SymmetricSecretKey, and PBKD/scrypt parameter classes was zeroised on garbage collection via Object.finalize. Finalization is non-deterministic and runs on...

CVE-2026-8798

CVE-2026-8798 affects Bouncy Castle for Java FIPS (BC-FJA) prior to bc-fips 2.1.3. The native entropy source on Intel platforms looped unbounded when RDSEED/RDRAND failed, risking a thread hang and potential denial of service as any operation using the native entropy source could stall. The fixes...

CVE-2026-57858

CVE-2026-57858 has publicly surfaced PoCs and a wormable exploit in connected sources. The available documents do not specify affected products, versions, root cause, impact, or remediation. Details in CIRCL sighting show two PoC entries pointing to a Telegram link (t.me/GithubRedTeam/97085). An ...

CVE-2026-52880

Klever-Go REST API (seednode and node) in versions 1.7.14–1.7.17 is affected by a denial-of-service via slow-header connections. The issue stems from Gin Engine.Run using Go’s default http.ListenAndServe with no ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes, allowing an unauthenticated client...

CVE-2026-47127

Summary: Ghostfolio prior to 3.4.0 allowed any authenticated user to self-grant a 1-year Premium subscription via the Stripe checkout success callback at GET /api/v1/subscription/stripe/callback?checkoutSessionId=, which unconditionally assigns the session’s client_reference_id without checking s...

CVE-2026-48122

CVE-2026-48122 affects the Ruby LSP VS Code extension (prior to 0.10.4). A repo containing a .vscode/settings.json could override startup paths for the Ruby executable, version manager executables, or the Bundler Gemfile, causing code to run with the developer’s privileges when the repository is ...

CVE-2026-52879

Summary: CVE-2026-52879 affects Klever-Go (Go implementation of Klever) where the direct-message ingress path spawns a new goroutine for every incoming direct message before the antiflood layer decides admission. This creates unbounded goroutine growth per peer, increasing stack allocations and G...

CVE-2026-48120

Kakoune (the code editor) is affected by CVE-2026-48120 through the bundled, enabled-by-default autorestore.kak script. Prior to version 2026.05.21, malicious backup files could trigger arbitrary Kakoune and shell commands when a file is opened. The issue is addressed in Kakoune 2026.05.21. A wor...

CVE-2026-52878

CVE-2026-52878 affects Klever-Go (versions 1.7.14–1.7.17). A nil RawData sub-message in protobuf Transaction triggers a nil-pointer panic when txVersionChecker.CheckTxVersion dereferences tx.RawData.Version without a nil check, causing a crash in the libp2p pubsub/the node process. The crash prop...

CVE-2026-48026

lakeFS contains a stored XSS in the Web UI Markdown renderer. Before versions 1.81.1 (OSS) and 1.84.0 (Enterprise), rendering README/markdown objects without HTML sanitization lets a user with write access commit a .md file containing arbitrary HTML/JavaScript; any user opening it in an authentic...

CVE-2026-49343

Summary of CVE-2026-49343 (Klever-Go KVM) In versions prior to 1.7.18 of Klever-Go, the account-data trie syncers leak bounded throttler slots on error paths in syncDataTrie(): StartProcessing() is called but EndProcessing() is only reached on success or a duplicate-root early return. As a result...

CVE-2026-46409

OpenYak exposes a local HTTP API bound to 127.0.0.1: without proper server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. This enables a malicious webpage the user visits to issue cross-origin requests to the local server, effectivel...

CVE-2026-48047

Affected component: XWiki Platform WebJars API (org.xwiki.platform:xwiki-platform-webjars-api). Vulnerability: Path traversal that can let an attacker write arbitrary files (e.g., configuration files or superadmin password) after installing a malicious WebJar extension and publishing it to a conf...

CVE-2026-47249

CVE-2026-47249 affects Klever-Go KVM (Go implementation of Klever) prior to v1.7.18. The issue is in P2P resolver request handling where a compressed RequestDataType_HashArrayType direct request (wire size ~442 bytes) can expand into about 200,000 decoded hash entries inside the resolver path. Th...

CVE-2026-58262

Klever-Go (Go implementation of the Klever blockchain protocol) contains a vulnerability prior to version 1.7.20 in header signature verification. The verification counts unused padding bits of the PubKeysBitmap toward the two-thirds validator quorum. These padding bits do not correspond to any v...

CVE-2026-64676

Kata Containers versions before 4.0.0: the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers deployments, the agent enforces an OPA/Rego-based AgentPolicy to authorize every ttRPC call; two mem-agent–related ttRPC methods miss ...

CVE-2026-47243

Kata Containers runtime-rs is affected by a guest-root to host-root escape in the virtio-fs path prior to version 3.31.0. In configurations using the host virtiofsd with --sandbox none and --seccomp none, a root-equivalent attacker inside the guest can bypass the guest virtio-fs client by taking ...

CVE-2026-48170

The CVE-2026-48170 issue affects the scim-patch library (SCIM PATCH processing). Before version 0.9.1, PATCH operations with a value object containing keys like proto .someProp can pollute Object.prototype, affecting all plain objects in the Node process. This can enable prototype pollution with ...

CVE-2026-48169

CVE-2026-48169 (PraisonAI Platform) has concrete cross-workspace IDOR and privilege-escalation flaws. The API routes enforce workspace membership but the service layer (in IssueService and ProjectService) performs global primary-key lookups (e.g., get/update/delete) without filtering by workspace...

CVE-2026-45808

CVE-2026-45808 affects OpenBao before version 2.5.4 , where cross-namespace lease revocation can be triggered by a tenant in another tenant via legacy undocumented endpoints sys/revoke and sys/renew , bypassing namespace ACLs. Root cause: insufficient access control for lease operations across te...

CVE-2026-46405

OpenBao's CVE-2026-46405 affects the Kerberos auth method in OpenBao prior to v2.5.4. The GET handler (and requests with Authorization: Negotiate) can cause the system to return a response that includes a hidden logical.Auth token alongside an error, resulting in tokens created with default polic...

CVE-2026-11742

CVE-2026-11742 describes a use-after-free race in Zephyr’s kernel queue helpers: z_queue_node_peek() can dereference a node after another thread preempts or unlinks it via k_queue_get(), because peek operations weren’t protected by the queue spinlock. A concurrent consumer may free the node and i...

CVE-2026-11743

The CVE concerns the SF32LB MPI QSPI NOR flash driver (drivers/flash/flash_sf32lb_mpi_qspi_nor.c). The vulnerability arises in the read/write paths where a signed offset (off_t) is compared against an unsigned size using (offset + size) > data->size, allowing a negative offset to wrap to a ...