@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
CVE-2026-62264
### Impact When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` en
#advisory
共收录 22911 条相关情报。
← 返回所有主题PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
CVE-2026-61438
### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
CVE-2026-61448
### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
CVE-2026-62160
### Summary Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.Par
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
CVE-2026-55186
### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password a
Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that ...
CVE-2026-93571
Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update req
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD ...
CVE-2026-93570
Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a craf
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticat...
CVE-2026-84294
Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 20
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From hea...
CVE-2026-66912
Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Cla
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, ...
CVE-2026-66911
Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can...
CVE-2026-119124
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause w
粤公网安备44030702002388号
粤公网安备44030702002388号
【云原生智能网关】控制台独立上线
【云原生智能网关】控制台独立上线
【EdgeOne】关于针对 PHP 核心远程代码执行漏洞的防护公告
【EdgeOne】关于针对 PHP 核心远程代码执行漏洞的防护公告
【腾讯云 EdgeOne】关于中国大陆网络优化计费项名称变更的公告
【腾讯云 EdgeOne】关于中国大陆网络优化计费项名称变更的公告
【对象存储】关于 COS 不再支持配置重定向回源规则及调整同步回源、异步回源“3xx 跟随”策略的通知
【对象存储】关于 COS 不再支持配置重定向回源规则及调整同步回源、异步回源“3xx 跟随”策略的通知
【机器翻译】文本翻译退市下线通知
【机器翻译】文本翻译退市下线通知
腾讯云传统账户类型（带宽非上移）下线公告
腾讯云传统账户类型（带宽非上移）下线公告
【腾讯云认证】从业者类别认证详情页升级公告
【腾讯云认证】从业者类别认证详情页升级公告