Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categ...

CVE-2026-117570

Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabil

历史摘要 · 未重新核验 · NVD

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data...

CVE-2026-115915

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-control

来源摘录 · NVD / GitHub Advisory

pypdf: Unvalidated JPEG image data loading

CVE-2026-113786

### Impact An attacker who uses this vulnerability can craft a PDF which leads to arbitrary image parsers being called.

历史摘要 · 未重新核验 · GitHub Advisory

Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability

CVE-2026-96229

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Micr

历史摘要 · 未重新核验 · GitHub Advisory

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker...

CVE-2026-89106

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could

历史摘要 · 未重新核验 · GitHub Advisory

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered ...

CVE-2026-89106

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitizatio...

CVE-2026-103687

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the f

历史摘要 · 未重新核验 · NVD

rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

CVE-2026-103687

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the f

历史摘要 · 未重新核验 · OSV.dev

A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0...

CVE-2026-12974

A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Secu

历史摘要 · 未重新核验 · NVD

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct explo...

CVE-2026-54694

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s

历史摘要 · 未重新核验 · NVD

NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

CVE-2026-54694

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a s

历史摘要 · 未重新核验 · OSV.dev

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Docker security.yaml includes /bin/bash in allowed_executab...

CVE-2026-55581

mcp-shell is an MCP server for running shell commands securely, auditably, and on demand. Prior to 0.6.0, the default Do

历史摘要 · 未重新核验 · NVD

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5...

CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated

历史摘要 · 未重新核验 · GitHub Advisory

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory const...

CVE-2026-63649

CVE-2026-63649 影响 OpenVPN 的 Windows 交互服务，涉及版本 2.4.0 至 2.6.21 以及 2.7_alpha1 至 2.7.5。该服务在处理配置文件时存在安全限制绕过漏洞。具体而言，本地认证用户能够构造

历史摘要 · 未重新核验 · NVD

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in...

CVE-2026-67315

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing re

历史摘要 · 未重新核验 · GitHub Advisory

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can...

CVE-2026-67315

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing re

历史摘要 · 未重新核验 · NVD

axios 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

CVE-2026-67315

axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing re

历史摘要 · 未重新核验 · OSV.dev

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

## Summary Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when

历史摘要 · 未重新核验 · GitHub Advisory

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the...

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation

历史摘要 · 未重新核验 · NVD

Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation

历史摘要 · 未重新核验 · OSV.dev