CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

# Unauthenticated HTTP MCP browser-control surface in `camofox-mcp` ## Summary `camofox-mcp` exposed a Streamable HTTP

历史摘要 · 未重新核验 · GitHub Advisory

SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

CVE-2026-46372

## Resolution SillyTavern 1.18.0 added a generic server-side request filter (Private Request Whitelisting). Since we ex

历史摘要 · 未重新核验 · GitHub Advisory

@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes

CVE-2026-45783

### Summary An unauthenticated remote peer can exhaust the disk storage of any `@libp2p/kad-dht` node running in server

历史摘要 · 未重新核验 · GitHub Advisory

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

CVE-2026-46342

### Summary The `/__nuxt_island/*` endpoint accepts attacker-controlled `props` query/body parameters and renders any i

历史摘要 · 未重新核验 · GitHub Advisory

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

CVE-2026-45805

### Summary The MCP module's `ReplServer` binds to all interfaces (`0.0.0.0:4403`) and exposes a `/execute` endpoint th

历史摘要 · 未重新核验 · GitHub Advisory

HAX CMS: Denial of Service using Malicious Import Request

CVE-2026-46357

### Summary The HAX CMS NodeJS application crashes when an authenticated attacker sends a specially crafted site creati

历史摘要 · 未重新核验 · GitHub Advisory

Trubo: Login callback CSRF/session fixation

CVE-2026-45773

### Impact Turborepo's self-hosted login and SSO browser flows did not validate a CSRF state value on the localhost cal

历史摘要 · 未重新核验 · GitHub Advisory

Turbo: Unexpected local code execution during Yarn Berry detection

CVE-2026-45772

### Impact Turborepo can be vulnerable to arbitrary code execution when run in untrusted repositories that contain ma

历史摘要 · 未重新核验 · GitHub Advisory

ws: Uninitialized memory disclosure

CVE-2026-45736

### Impact The `websocket.close()` implementation is vulnerable to uninitialized memory disclosure when a `TypedArray`

历史摘要 · 未重新核验 · GitHub Advisory

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

Mistral npm `@mistralai/mistralai`, `@mistralai/mistralai-azure`, `@mistralai/mistralai-gcp` were compromised by a suppl

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API

CVE-2026-45719

# Security Advisory: CouchDB Reduce Injection via Unsanitized Calculation Parameter in V1 Views API **Affected Software

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

CVE-2026-45718

## Summary The row action trigger endpoint (`POST /api/tables/:sourceId/actions/:actionId/trigger`) fails to validate t

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: Builder-to-Admin Privilege Escalation via onboardUsers Endpoint Without SMTP Configuration

CVE-2026-45716

## Summary The `POST /api/global/users/onboard` endpoint is protected by `workspaceBuilderOrAdmin` middleware, allowing

历史摘要 · 未重新核验 · GitHub Advisory

n8n-MCP: Multi-tenant MCP requests fall back to process-level n8n credentials when tenant headers are absent or incomplete

CVE-2026-45707

## Summary When `ENABLE_MULTI_TENANT=true`, the HTTP transport documents that the target n8n instance is selected per-r

历史摘要 · 未重新核验 · GitHub Advisory

multiparty vulnerable to ReDoS via filename parsing

CVE-2026-8159

### Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking

历史摘要 · 未重新核验 · GitHub Advisory

multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing

CVE-2026-8162

### Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a

历史摘要 · 未重新核验 · GitHub Advisory

multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

CVE-2026-8161

### Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a

历史摘要 · 未重新核验 · GitHub Advisory

@tmlmobilidade/utils has prototype pollution in its setValueAtPath

CVE-2026-45325

### Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath(). ### Patches A fix is availab

历史摘要 · 未重新核验 · GitHub Advisory

dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport

## Summary dynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive `rmcp` dependency, plus a r

历史摘要 · 未重新核验 · GitHub Advisory

parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names

CVE-2026-45302

## Summary `parseFormData()` walks bracket and dot-notation FormData field names into nested objects without filtering

历史摘要 · 未重新核验 · GitHub Advisory