MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
CVE-2026-55854
### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in
#npm
共收录 1041 条相关情报。
← 返回所有主题libreoffice-convert vulnerable to path traversal / arbitrary file write
CVE-2026-54732
### Impact options.fileName is used to build a filesystem path (path.join(tempDir.name, fileName)) and the caller-suppli
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
CVE-2026-54687
## Affected versions < 1.0.0 ## Patched version 1.0.0 ## Description In versions prior to 1.0.0, the SQLite node accep
SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
CVE-2026-54606
Summary A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed
@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
CVE-2026-54511
`@logtape/syslog` contains two related output-encoding bugs in the structured data formatting code. Both only affect dep
Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
CVE-2026-54356
### Summary Budibase 3.39.7 allows a low-privilege authenticated published-app user with the built-in BASIC role to obta
@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint
CVE-2026-55605
## Summary The self-hosted HTTP transport of `@arikusi/deepseek-mcp-server` exposes `POST /mcp` without any authenticati
@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key
CVE-2026-55604
# Cross-Session Data Exposure via Caller-Controlled `session_id` Project / Repository: `arikusi/deepseek-mcp-server`
consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write
CVE-2026-55609
### Impact An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the `consciou
Whistle vulnerable to path traversal
CVE-2026-55629
This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, indep
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
CVE-2026-55663
### Summary mediasoup's built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcod
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
CVE-2026-55596
## Summary The media embed renderer trusts serialized `provider` or `sourceUrl` metadata and skips the URL protocol val
browse-mcp has an arbitrary file write via unconfined download and state paths
CVE-2026-55557
### Impact `browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`, and `
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
CVE-2026-55553
## Summary urllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client.
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
CVE-2026-77415
Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to: - overwri
JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions
CVE-2026-77414
Before JSONata `2.2.1` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to a bypassab
JSONata: Arbitrary Code Execution via crafted JSONata expressions
CVE-2026-77413
## Impact Before JSONata `2.2.0` and `1.8.8` it was possible to execute arbitrary code with crafted expressions, due to
Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
CVE-2026-63421
# Summary The value of `graphql.maxTake` can be bypassed by providing a negative input. This can be used to exceed the d
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
CVE-2026-61824
## Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
CVE-2026-63466
## Vulnerability Details **File**: `src/lib/addons/feature-event-formatter-md.ts` **Line**: 355 (in v8.0.1; `format()`