dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters
CVE-2026-44968
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/
2026-07-17 归档
今日共收录 1302 条安全情报，包含 372 个 CVE，507 篇安全通告，以及 120 篇研究论文。
← 返回归档列表Manyfold: Authenticated Path Traversal via File Rename
CVE-2026-46336
Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on
HireFlow: Use of Hard-coded Credentials
CVE-2026-45336
HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring
Emlog Local File Inclusion (LFI)
CVE-2026-46687
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-t
Emlog Reflected Cross-Site Scripting
CVE-2026-46686
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword p
Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
CVE-2026-46341
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
CVE-2026-45367
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.7,
zrok copy writes attacker-controlled WebDAV paths outside the destination root
CVE-2026-45576
zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores at
zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
CVE-2026-45568
zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Fl
stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass
CVE-2026-63088
stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-
Squid: Memory corruption in cache_digest reply handling
CVE-2026-50012
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handli
Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
CVE-2026-46621
Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamica
Yamcs: Remote Code Execution via Mission Database algorithm override
CVE-2026-46562
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScrip
Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
CVE-2026-44632
Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs a
Yamcs: No Rate Limiting on Authentication Endpoint
CVE-2026-44596
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handl
Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint
CVE-2026-63087
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a
Yamcs: Unauthorized user enumeration via IAM API endpoints
CVE-2026-44595
Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGrou
Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
CVE-2026-47751
Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to
Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
CVE-2026-55407
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the dec
Axelor Open Platform 8.x < 8.2.2 Authorization Bypass via Nested Relational Record Persistence
CVE-2026-63085
Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticate