Aggregator

A vulnerability has been found in Algovate xhs-mcp 0.8.11 and classified as critical. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP Interface. Performing a manipulation of the argument media_paths results in server-side request forgery. This vulnerability was named CVE-2026-7417. The attack may be initiated remotely. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535 and classified as critical. This vulnerability affects the function strcpy of the file route/goform/NTP. Executing a manipulation of the argument Profile can lead to buffer overflow. The identification of this vulnerability is CVE-2026-7418. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. It has been classified as critical. This issue affects the function strcpy of the file route/goform/formTaskEdit_ap. The manipulation of the argument Profile leads to buffer overflow. This vulnerability is referenced as CVE-2026-7419. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. It has been declared as critical. Impacted is the function strcpy of the file route/goform/ConfigAdvideo. The manipulation of the argument Profile results in buffer overflow. This vulnerability is identified as CVE-2026-7420. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in BurtTheCoder mcp-dnstwist up to 1.0.4. It has been declared as critical. Affected by this vulnerability is the function fuzz_domain of the file src/index.ts of the component MCP Interface. Executing a manipulation of the argument Request can lead to os command injection. The identification of this vulnerability is CVE-2026-7443. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

JPCERT/CCが提供するLogonTracerには、複数の脆弱性があります。この問題は、当該製品を修正済みのバージョンに更新することで解決します。詳細は、JPCERT/CCが提供する情報を参照してください。

推动教育向全面智能化升级。

A China-aligned threat group is exploiting unpatched Microsoft Exchange vulnerabilities to conduct cyberespionage against government and critical infrastructure targets across Asia and beyond.

SUSE Manager 4.3.15 - Code Execution

deephas 1.0.7 - Prototype Pollution

Erugo 0.2.14 - Remote Code Execution (RCE)

Cybersecurity AI (CAI) Framework 0.5.10 - Command Injection

Camaleon CMS v2.9.0 - Path Traversal

Js2Py 0.74 - RCE

Frigate NVR 0.16.3 - Remote Code Execution

NiceGUI 3.6.1 - Path Traversal

SumatraPDF 3.5.2 - Remote Code Execution

JUNG Smart Visu Server 1.1.1050 - Dos

Windows 11 25H2 - Heap Overflow