@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

CVE-2026-55604

# Cross-Session Data Exposure via Caller-Controlled `session_id` Project / Repository: `arikusi/deepseek-mcp-server`

历史摘要 · 未重新核验 · GitHub Advisory

consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

CVE-2026-55609

### Impact An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the `consciou

历史摘要 · 未重新核验 · GitHub Advisory

Whistle vulnerable to path traversal

CVE-2026-55629

This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, indep

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser vulnerable to DoS via deeply nested parens in Received headers

CVE-2026-55620

### Summary `eml_parser` strips parenthesised CFWS comments from `Received:` headers using a regex-based fix-point loop

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

CVE-2026-55619

### Summary `eml_parser` uses the `email.utils.getaddresses()` function from the CPython standard library to parse e-ma

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser has a URL extraction bypass via HTML entities in URLs

CVE-2026-55618

## Summary `eml_parser` performs certain validations on potential URL strings to discard bogus values. In versions prio

历史摘要 · 未重新核验 · GitHub Advisory

AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching

CVE-2026-49757

### Summary AshAuthentication's OAuth2 and OIDC family strategies matched the local user by email address rather than b

历史摘要 · 未重新核验 · GitHub Advisory

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

CVE-2026-55663

### Summary mediasoup's built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcod

历史摘要 · 未重新核验 · GitHub Advisory

gRPC Erlang package has unbounded gzip decompression (decompression bomb)

CVE-2026-53430

### Summary An unauthenticated remote peer can crash any gRPC server built on this library by sending a small gzip-compr

历史摘要 · 未重新核验 · GitHub Advisory

gRPC Erlang package has unbounded request body accumulation in `read_full_body/3`

CVE-2026-48854

### Summary `'Elixir.GRPC.Server.Adapters.Cowboy.Handler':read_full_body/3` accumulates every received chunk into a sin

历史摘要 · 未重新核验 · GitHub Advisory

gRPC Erlang package's path bindings are overridable by query string and request body

CVE-2026-48599

### Summary In the HTTP-to-gRPC transcoding layer of the `grpc` Hex package, query-string and request-body parameters c

历史摘要 · 未重新核验 · GitHub Advisory

gRPC Erlang package vulnerable to Remote Code Execution with attacker-controlled gRPC payloads

CVE-2026-48853

### Summary `GRPC.Codec.Erlpack.decode/2` calls `:erlang.binary_to_term/1` directly on the raw gRPC message body withou

历史摘要 · 未重新核验 · GitHub Advisory

genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

CVE-2026-55637

`genieacs-mcp` exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled `Host` and `Origin` headers

历史摘要 · 未重新核验 · GitHub Advisory

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment

### Summary `mcpgateway.services.prompt_service.PromptService` renders user-supplied prompt templates using Jinja2's pl

历史摘要 · 未重新核验 · GitHub Advisory

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

CVE-2026-55419

## Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file valid

历史摘要 · 未重新核验 · GitHub Advisory

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

CVE-2026-55092

## Summary When Trivy downloads an OCI artifact, it uses the `org.opencontainers.image.title` annotation from the artif

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

## Overview When phpMyFAQ hardened its admin permission-assignment endpoints against privilege escalation, it added a "

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ public FAQ APIs expose inactive FAQ content

## Affected Product phpMyFAQ ## Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: curren

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

## Summary There is an authenticated path traversal condition in the PDF export functionality, specifically within the

历史摘要 · 未重新核验 · GitHub Advisory

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

CVE-2026-55596

## Summary The media embed renderer trusts serialized `provider` or `sourceUrl` metadata and skips the URL protocol val

历史摘要 · 未重新核验 · GitHub Advisory