A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome....
CVE-2026-82813
A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the functi
#advisory
共收录 23717 条相关情报。
← 返回所有主题A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown...
CVE-2026-82817
A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the fil
A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the...
CVE-2026-82815
A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of th
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015...
CVE-2026-51730
Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated att
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows...
CVE-2026-51729
Incorrect access control in the delDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers
FLVMeta AMF String Processing amf.c amf_string_new heap-based overflow
CVE-2026-82820
A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf_string_new of the file src/amf.c of the c
I3C IBI work-node free-list data race between ISR and workqueue thread
CVE-2026-14367
The I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c hands out statically-allocated work nodes through a free-list i3c_i
MCPHub: Path Traversal via Malicious MCPB Manifest Name
CVE-2026-79743
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration
CVE-2026-79744
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)
CVE-2026-79745
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: Server-scoped bearer key gains access to an entire group via partial (any-overlap) server matching
CVE-2026-79746
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
CVE-2026-79747
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)
CVE-2026-79748
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
CVE-2026-79749
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
MCPHub authenticated horizontal IDOR: any non-admin user executes tools on other users' MCP servers (cross-tenant file read + SSRF)
CVE-2026-79750
MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep
CVE-2026-19953
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in
SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt
CVE-2026-14366
The Silicon Labs SiWx917 WiFi driver's transmit callback siwx91x_send() in drivers/wifi/siwx91x/siwx91x_wifi.c frees a n
zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID
CVE-2026-78422
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned
Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown
CVE-2026-82881
Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored c
YaCy Search Server through 1.941 XML External Entity Injection via Parsers
CVE-2026-82880
YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearc