CVE-2026-108976 | High | 7.8 | 2026-10-11 | GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed input… |
CVE-2026-107322 | High | 7.8 | 2026-10-08 | An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to exec… |
CVE-2026-106556 | High | 7.7 | 2026-10-07 | Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass… |
CVE-2026-106445 | | | 2026-10-06 | Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.co… |
CVE-2026-106442 | High | 7.8 | 2026-10-06 | Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for C… |
CVE-2026-106218 | High | 8.8 | 2026-10-06 | In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible |
CVE-2026-105791 | High | 7.5 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecuto… |
CVE-2026-105789 | Medium | 5.4 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/h… |
CVE-2026-105650 | High | 8.1 | 2026-10-05 | Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts be… |
CVE-2026-105648 | Medium | 4.0 | 2026-10-05 | Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an u… |
CVE-2026-103687 | High | 7.3 | 2026-10-01 | A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the compone… |
CVE-2026-101884 | High | 7.5 | 2026-09-30 | OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOK… |
CVE-2026-101882 | High | 8.8 | 2026-09-30 | OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and ab… |
CVE-2026-100253 | High | 8.8 | 2026-09-30 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL |
CVE-2026-102829 | | | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of… |
CVE-2026-102828 | Critical | 9.8 | 2026-09-29 | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until… |
CVE-2026-55096 | High | 7.1 | 2026-09-28 | fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, whi… |
CVE-2026-63206 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and… |
CVE-2026-61788 | High | 7.4 | 2026-09-24 | DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql… |
CVE-2026-97149 | | | 2026-09-24 | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, ex… |
CVE-2026-84714 | High | 7.1 | 2026-09-23 | A flaw was found in the automation-controller input-validation
guard sanitize_jinja(). The function uses two regular
expres… |
CVE-2026-84706 | High | 7.6 | 2026-09-23 | A flaw was found in Ansible Automation Platform's automation-controller. The custom
Credential Type environment-variable injector validates variable names agai… |
CVE-2026-75884 | Critical | 9.1 | 2026-09-23 | A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing in… |
CVE-2026-67615 | High | 8.8 | 2026-09-22 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary cod… |
CVE-2026-61851 | | | 2026-09-21 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQ… |
CVE-2026-93598 | | | 2026-09-18 | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyg… |
CVE-2026-63671 | High | 8.1 | 2026-09-16 | MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nuxtjs/mdc uses parseMarkdown with allowD… |
CVE-2026-11918 | Medium | 5.4 | 2026-09-15 | IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive insp… |
CVE-2026-57138 | Critical | 9.9 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript wit… |
CVE-2026-90808 | Medium | 6.3 | 2026-09-14 | A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/s… |
CVE-2026-87985 | | | 2026-09-11 | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments… |
CVE-2026-87911 | Critical | 9.6 | 2026-09-09 | An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an… |
CVE-2026-85788 | Medium | 5.5 | 2026-09-09 | Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass th… |
CVE-2026-86199 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger a… |
CVE-2026-79696 | | | 2026-09-09 | A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 on Python (OSS), Cloud Run, and G… |
CVE-2026-82536 | High | 8.8 | 2026-09-08 | Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands… |
CVE-2026-70334 | High | 7.8 | 2026-09-08 | Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-69624 | Medium | 6.5 | 2026-09-08 | Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network. |
CVE-2026-33197 | | | 2026-09-08 | AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitati… |
CVE-2026-85787 | Medium | 6.5 | 2026-09-04 | An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-mcp-server before version 1.1.7 might allow an unauthentica… |
CVE-2026-77124 | High | 7.2 | 2026-09-02 | In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had… |
CVE-2026-84370 | High | 8.2 | 2026-09-01 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and… |
CVE-2026-84218 | High | 8.1 | 2026-09-01 | A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist i… |
CVE-2026-56547 | Low | 3.5 | 2026-08-26 | The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Addres… |
CVE-2026-52776 | | | 2026-08-26 | Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurity… |
CVE-2026-65083 | Critical | 9.9 | 2026-08-25 | NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A s… |
CVE-2026-76072 | High | 7.4 | 2026-08-24 | The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the d… |
CVE-2026-62676 | High | 7.1 | 2026-08-21 | Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, the shared shell-command parser in omnigent/pol… |
CVE-2026-18356 | Low | 3.7 | 2026-08-21 | The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account f… |
CVE-2026-72860 | High | 8.5 | 2026-08-20 | The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination wit… |
CVE-2026-68921 | Medium | 4.7 | 2026-08-20 | DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute witho… |
CVE-2026-49825 | High | 8.2 | 2026-08-20 | lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:hre… |
CVE-2026-45741 | High | 7.5 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002… |
CVE-2026-74886 | Critical | 9.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST… |
CVE-2026-73650 | High | 8.2 | 2026-08-13 | SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and… |
CVE-2026-73484 | High | 8.1 | 2026-08-13 | Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like to_csv, to_json… |
CVE-2026-73492 | | | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTM… |
CVE-2026-73491 | | | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTM… |
CVE-2026-70466 | Medium | 5.3 | 2026-08-12 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWe… |
CVE-2026-73078 | High | 8.8 | 2026-08-11 | Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.v… |
CVE-2026-72779 | Medium | 4.5 | 2026-08-11 | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create() Twig function restricts class instanti… |
CVE-2026-17630 | High | 7.2 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters. |
CVE-2026-71259 | High | 8.6 | 2026-08-05 | ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file… |
CVE-2026-70470 | Critical | 9.8 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/com… |
CVE-2026-69263 | Critical | 9.8 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes… |
CVE-2026-18174 | Medium | 5.3 | 2026-07-29 | @fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated en… |
CVE-2026-50251 | Medium | 5.3 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled (set to any value greater than zero), glue records of 0.0… |
CVE-2026-47392 | Critical | 9.9 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `execute_code()` in `praison… |
CVE-2026-63108 | High | 8.8 | 2026-07-20 | Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enfor… |
CVE-2026-16129 | Medium | 5.3 | 2026-07-18 | A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safe… |
CVE-2026-13448 | High | 8.1 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/b… |
CVE-2026-62203 | High | 8.8 | 2026-07-17 | OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables… |
CVE-2026-52888 | Medium | 6.8 | 2026-07-15 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. In 2.0.59 and earlier, NocoBase @nocobase/plug… |
CVE-2026-48736 | High | 8.6 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNe… |
CVE-2026-45753 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttribu… |
CVE-2026-45066 | Medium | 6.1 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSaniti… |
CVE-2026-15625 | Medium | 6.3 | 2026-07-14 | A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function ExecApprovalManager.CheckCommand of the file internal/tools… |
CVE-2026-62200 | High | 8.8 | 2026-07-13 | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature… |
CVE-2026-62199 | High | 8.8 | 2026-07-13 | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is e… |
CVE-2026-55830 | High | 8.3 | 2026-07-08 | RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8… |
CVE-2026-59929 | Medium | 6.1 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter in src/mistune/renderers/html.py blocks only javascript:, v… |
CVE-2026-59261 | High | 7.1 | 2026-07-08 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-tru… |
CVE-2026-14534 | High | 8.8 | 2026-07-04 | Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_… |
CVE-2026-56777 | Medium | 5.0 | 2026-06-30 | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator bypass in the Python Code node. An authenticated user with… |
CVE-2025-71355 | | | 2026-06-30 | Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code… |
CVE-2026-49869 | Critical | 10.0 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("… |
CVE-2026-54090 | | | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when… |
CVE-2026-57234 | Low | 2.6 | 2026-06-25 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default… |
CVE-2026-54070 | High | 7.1 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README f… |
CVE-2026-47389 | High | 8.6 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, Priva… |
CVE-2026-53944 | Medium | 5.8 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the… |
CVE-2026-54513 | High | 8.1 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4… |
CVE-2026-54512 | High | 8.1 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4… |
CVE-2026-56315 | Critical | 9.8 | 2026-06-23 | picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib)… |
CVE-2025-71351 | | | 2026-06-21 | picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers ca… |
CVE-2026-53873 | Critical | 9.8 | 2026-06-17 | picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers… |
CVE-2025-71323 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw me… |
CVE-2025-71320 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass se… |
CVE-2026-55743 | Critical | 9.6 | 2026-06-17 | The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execut… |
CVE-2026-44587 | Medium | 4.7 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex… |