A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function...

CVE-2026-81491

A flaw has been found in boxpositron with-context-mcp up to 3.0.7. This affects the function ingest_notes/teleport_notes

历史摘要 · 未重新核验 · GitHub Advisory

A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's...

CVE-2026-16895

A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service i

历史摘要 · 未重新核验 · GitHub Advisory

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

CVE-2026-54590

**Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h).** The 2.23.0 guard that sanitises the SSH username before `

历史摘要 · 未重新核验 · GitHub Advisory

cakephp/debug_kit: MailPreview contains unsafe reflection

CVE-2026-54614

### Impact The `MailPreview` feature of debugkit is vulnerable to arbitrary constructor execution. For an application t

历史摘要 · 未重新核验 · GitHub Advisory

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

## Summary OpenWISP IPAM is multi-tenant: every `Subnet` belongs to an `organization`, and API access is scoped to the

历史摘要 · 未重新核验 · GitHub Advisory

AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

CVE-2026-55688

### Impact A **cookie tossing / cookie injection** issue (CWE-1275). `ThreadSafeCookieStore` stored a cookie under the

历史摘要 · 未重新核验 · GitHub Advisory

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

CVE-2026-54553

## Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is...

CVE-2026-79912

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTi

历史摘要 · 未重新核验 · GitHub Advisory

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS...

CVE-2026-80185

BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested Ser

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability...

CVE-2026-79845

A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was found in SililaWijesinghe Food Ordering System up to...

CVE-2026-79804

A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affec

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image...

CVE-2026-80101

A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validate

历史摘要 · 未重新核验 · GitHub Advisory

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

CVE-2026-54338

### Impact Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM

历史摘要 · 未重新核验 · GitHub Advisory

@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

CVE-2026-55605

## Summary The self-hosted HTTP transport of `@arikusi/deepseek-mcp-server` exposes `POST /mcp` without any authenticati

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser has parser DoS via deeply nested parentheses in e-mail headers

CVE-2026-55619

### Summary `eml_parser` uses the `email.utils.getaddresses()` function from the CPython standard library to parse e-ma

历史摘要 · 未重新核验 · GitHub Advisory

eml_parser has a URL extraction bypass via HTML entities in URLs

CVE-2026-55618

## Summary `eml_parser` performs certain validations on potential URL strings to discard bogus values. In versions prio

历史摘要 · 未重新核验 · GitHub Advisory

mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

CVE-2026-55663

### Summary mediasoup's built-in SCTP stack (introduced in v3.20.0) authenticates SCTP state cookies using only hardcod

历史摘要 · 未重新核验 · GitHub Advisory

reachy_mini Allows Unrestricted Upload of File with Dangerous Type

CVE-2026-55419

## Summary The Reachy Mini daemon exposes the “/api/media/sounds/upload” endpoint without authentication and file valid

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ public FAQ APIs expose inactive FAQ content

## Affected Product phpMyFAQ ## Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: curren

历史摘要 · 未重新核验 · GitHub Advisory

phpMyFAQ has Potential Authenticated Path Traversal in PDF Export

## Summary There is an authenticated path traversal condition in the PDF export functionality, specifically within the

历史摘要 · 未重新核验 · GitHub Advisory