Aggregator

A vulnerability was found in ChrisChinchilla Vale-MCP up to 0.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file src/index.ts of the component HTTP Interface. The manipulation of the argument config_path results in os command injection. This vulnerability is known as CVE-2026-5621. Attacking locally is a requirement. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in itsourcecode Construction Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /borrowed_equip_report.php of the component Parameter Handler. The manipulation of the argument Home leads to sql injection. This vulnerability is traded as CVE-2026-5620. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Braffolk mcp-summarization-functions up to 0.1.5 and classified as critical. This impacts an unknown function of the file src/server/mcp-server.ts of the component summarize_command. Executing a manipulation of the argument command can lead to os command injection. This vulnerability appears as CVE-2026-5619. The attack requires local access. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Submit #785591 / VDB-355411

Биогибридные компьютеры перестали быть фантастикой?

Submit #785577 / VDB-355410

axios 被黑始末 by ourren

从4.8亿下载量的 LiteLLM投毒事件，看 AI 基础设施安全攻与防 by 路人甲

CyberStrikeLab Lab12 弱口令打穿内网 by 路人甲

基于掩码图注意力网络的漏洞情报对齐 by ourren

关于威胁情报平台（TIP）建设的思考 by ourren

更多最新文章，请访问SecWiki

Submit #785574 / VDB-355409

A vulnerability has been found in kalcaddle kodbox up to 1.64 and classified as critical. This affects an unknown function of the component shareMake/shareCheck. Performing a manipulation of the argument siteFrom/siteTo results in server-side request forgery. This vulnerability is reported as CVE-2026-5618. The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

Canonical 即将于本月晚些时候正式释出的 Ubuntu 26.04 LTS 把最低内存需求提高到了 6GB。Ubuntu 14.04 LTS (Trusty Tahr)将最低内存需求设为 1GB，Ubuntu 18.04 LTS (Bionic Beaver)提高到 4GB，现在又一次提高了内存需求。相比下，微软将 Windows 11 的最低内存需求设为 4GB，当然这不过是微软的又一个谎言，没人真的会在只有 4GB 内存的计算机运行微软的最新操作系统，Windows 11 至少需要 8GB 内存。Canonical 并没有将 6GB 内存作为硬条件，用户仍然能在不到 6GB 内存的计算机上安装 Ubuntu 26.04。

A vulnerability, which was classified as critical, was found in JeecgBoot 3.9.0/3.9.1. The impacted element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/airag/JeecgBizToolsProvider.java of the component AI Chat Module. Such manipulation leads to missing authentication. This vulnerability is documented as CVE-2026-5616. The attack can be executed remotely. There is not any exploit available. It is best practice to apply a patch to resolve this issue. The project fixed the issue with a commit which shall be part of the next official release.

Submit #785572 / VDB-355408

Keitaro 是一款自托管的广告流量分发与效果跟踪系统，原生具备的精细化流量路由、受众定向、内容伪装能力，被

Submit #785570 / VDB-355407

A vulnerability, which was classified as problematic, has been found in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. This vulnerability is registered as CVE-2026-5615. Remote exploitation of the attack is possible. Furthermore, an exploit is available. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A vulnerability classified as critical was found in Belkin F9K1015 1.00.10. Impacted is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument webpage results in stack-based buffer overflow. This vulnerability is cataloged as CVE-2026-5614. The attack may be launched remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical has been found in Belkin F9K1015 1.00.10. This issue affects the function formReboot of the file /goform/formReboot. The manipulation of the argument webpage leads to stack-based buffer overflow. This vulnerability is listed as CVE-2026-5613. The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability described as critical has been identified in Belkin F9K1015 1.00.10. This vulnerability affects the function formWlEncrypt of the file /goform/formWlEncrypt. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. This vulnerability is tracked as CVE-2026-5612. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability marked as critical has been reported in Belkin F9K1015 1.00.10. This affects the function formCrossBandSwitch of the file /goform/formCrossBandSwitch. Performing a manipulation of the argument webpage results in stack-based buffer overflow. This vulnerability is identified as CVE-2026-5611. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability labeled as critical has been found in Belkin F9K1015 1.00.10. Affected by this issue is the function formWISP5G of the file /goform/formWISP5G. Such manipulation of the argument webpage leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2026-5610. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.