genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport

CVE-2026-55637

`genieacs-mcp` exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled `Host` and `Origin` headers

历史摘要 · 未重新核验 · GitHub Advisory

mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment

### Summary `mcpgateway.services.prompt_service.PromptService` renders user-supplied prompt templates using Jinja2's pl

历史摘要 · 未重新核验 · GitHub Advisory

Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts

CVE-2026-55092

## Summary When Trivy downloads an OCI artifact, it uses the `org.opencontainers.image.title` annotation from the artif

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not hold

## Overview When phpMyFAQ hardened its admin permission-assignment endpoints against privilege escalation, it added a "

历史摘要 · 未重新核验 · GitHub Advisory

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

CVE-2026-55596

## Summary The media embed renderer trusts serialized `provider` or `sourceUrl` metadata and skips the URL protocol val

历史摘要 · 未重新核验 · GitHub Advisory

browse-mcp has an arbitrary file write via unconfined download and state paths

CVE-2026-55557

### Impact `browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`, and `

历史摘要 · 未重新核验 · GitHub Advisory

qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

CVE-2026-55585

### Summary The `qwed` package (version 5.1.1) passes attacker-controlled input directly to SymPy's `parse_expr()` func

历史摘要 · 未重新核验 · GitHub Advisory

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

CVE-2026-55553

## Summary urllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client.

历史摘要 · 未重新核验 · GitHub Advisory

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

CVE-2026-55677

### Summary Echo's router and static file handler disagree on URL path decoding. The router matches routes using the ra

历史摘要 · 未重新核验 · GitHub Advisory

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

CVE-2026-55571

### Impact djust's `LiveViewConsumer` mounts a `LiveView` over a WebSocket. When a view is gated (`login_required` / `p

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat...

CVE-2026-78268

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Tel

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.

CVE-2026-78282

Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.

CVE-2026-78264

Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.

CVE-2026-78259

Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.

CVE-2026-32556

Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice...

CVE-2026-32560

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versio

历史摘要 · 未重新核验 · GitHub Advisory

Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

CVE-2026-32561

Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

历史摘要 · 未重新核验 · GitHub Advisory

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

CVE-2026-78263

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

历史摘要 · 未重新核验 · GitHub Advisory

A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds...

CVE-2026-7455

A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A

历史摘要 · 未重新核验 · GitHub Advisory