NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

CVE-2026-54446

## Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode ### Summary When `netlicensing-mcp` is run in

历史摘要 · 未重新核验 · GitHub Advisory

Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

### Summary `SignedDataVerifier` attempts to perform online revocation checking when `enable_online_checks=True`, but it

历史摘要 · 未重新核验 · GitHub Advisory

json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

## Circular JSON Schema `$ref` causes unbounded CPU DoS in `json_repair` ### Summary `SchemaRepairer.resolve_schema()`

历史摘要 · 未重新核验 · GitHub Advisory

DIRAC: SQL injection and lack of access control in PilotManager service

### Details A number of the functions in PilotManager pass parameters directly through to the database layer, which then

历史摘要 · 未重新核验 · GitHub Advisory

DIRAC: Pilot code downloaded over unverified HTTPS connection

CVE-2026-61668

### Summary The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of t

历史摘要 · 未重新核验 · GitHub Advisory

DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

CVE-2026-61667

### Summary The FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query con

历史摘要 · 未重新核验 · GitHub Advisory

DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

CVE-2026-45579

### Summary An remote code execution vulnerability exists in RequestManager due to the use of eval on untrusted input th

历史摘要 · 未重新核验 · GitHub Advisory

Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset

### Summary A Clauster instance bound to a **non-loopback** address (e.g. `0.0.0.0` or a LAN IP) can serve the entire da

历史摘要 · 未重新核验 · GitHub Advisory

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

### Summary `confluence_upload_attachment` passes `file_path` directly to `open(file_path, "rb")` with no path validatio

历史摘要 · 未重新核验 · GitHub Advisory

mcp-atlassian: Arbitrary server-side file read via attachment upload

### Summary A client that can invoke MCP tools can read **arbitrary files from the server host** and exfiltrate them as

历史摘要 · 未重新核验 · GitHub Advisory

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

CVE-2026-54071

## Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py ### Summary BabelDOC's vend

历史摘要 · 未重新核验 · GitHub Advisory

CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

### Summary CredSweeper's deep scanner does not enforce `recursive_limit_size` as a hard limit. Several recursive scanne

历史摘要 · 未重新核验 · GitHub Advisory

MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix (CVE-2026-27826)

### Summary GHSA-7r34-79r5-rcc9's fix added `validate_url_for_ssrf`, which resolves the attacker-controlled `X-Atlassian

历史摘要 · 未重新核验 · GitHub Advisory

Mistune: Potential DoS via quadratic-time parsing in parse_link_text

CVE-2026-49851

### Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_lin

历史摘要 · 未重新核验 · GitHub Advisory

psd-tools vulnerable to arbitrary file write via smart-object filename

CVE-2026-49836

# psd-tools: arbitrary file write/read via smart-object path traversal ## Summary In `psd-tools` (all releases exposin

历史摘要 · 未重新核验 · GitHub Advisory

Rattler vulnerable to package cache path traversal via conda package build string

CVE-2026-53956

`rattler_cache` and `py-rattler` were vulnerable to package-cache path traversal when handling package metadata from con

历史摘要 · 未重新核验 · GitHub Advisory

pypdf: Possible infinite loop when processing threads/articles in writer

CVE-2026-54651

### Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires mergi

历史摘要 · 未重新核验 · GitHub Advisory

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

CVE-2026-49471

### Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 2428

历史摘要 · 未重新核验 · GitHub Advisory

Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handler

## Summary `trapster.libs.dns.decode_labels()` decodes DNS names from attacker-supplied UDP packets and recurses **once

历史摘要 · 未重新核验 · GitHub Advisory

`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

CVE-2026-49825

# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`) **Reporter:

历史摘要 · 未重新核验 · GitHub Advisory