CVE-2026-11720 — Critical vulnerability brief
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes…
Tag: Critical CVE
CVE-2026-31928 — Critical vulnerability brief
The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed…
CVE-2026-54350 — Critical vulnerability brief
Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the…
CVE-2026-54636 — Critical vulnerability brief
Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running…
CVE-2026-48930 — Critical vulnerability brief
A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lead to silent authority rebinding due to c-string truncation in…
CVE-2025-71333 — Critical vulnerability brief
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can…
CVE-2025-71338 — Critical vulnerability brief
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers…
CVE-2026-56786 — Critical vulnerability brief
RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing…
CVE-2026-50548 — Critical vulnerability brief
Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by…
CVE-2026-56123 — Critical vulnerability brief
socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap…