mpp vulnerable to Gas Draining with low gas limit
## Vulnerability When the server acts as the fee payer, `mpp` Elixir 0.4.0 (ZenHive/mpp) does not validate whether the `
#severity:high
共收录 5373 条相关情报。
← 返回所有主题mpp vulnerable to Gas Draining with no limit
### Details When the server acts as the fee_payer, the `mpp` Elixir 0.4.0 does not validate `gas_limit`, `max_fee_per_ga
CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
CVE-2026-100368
### Impact An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the `CliInv
CliInvoke: Argument Injection in Extensibility Runner Factory
CVE-2026-100369
### Impact An argument-injection vulnerability exists in the `CliInvoke` package's runner factory: `RunnerProcessFactory
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
### Summary The `/home/{file_path:path}` endpoint in `web_client.py` serves static files by directly concatenating the u
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
CVE-2026-86439
## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memo
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
### Impact Two locations consume an encrypted handle returned by an untrusted external party and use it without verifyi
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI)...
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dash
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears...
CVE-2026-97731
MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied
Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system...
CVE-2026-85082
Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely sep
Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as...
CVE-2026-87722
Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate,
Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser ...
CVE-2026-87721
Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerr
Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and...
CVE-2026-87720
Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction l
The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and...
CVE-2026-82585
The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An at
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users...
CVE-2026-95699
Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT
The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be...
CVE-2026-79959
The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. A
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before...
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extensio
The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server...
CVE-2026-82708
The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with acce
The Botslab G980H dash camera firmware generates session identifiers using a small sequential...
CVE-2026-85496
The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows...
CVE-2026-93354
Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers t