•23 minutes ago•CVE-2026-55619
5.3CVE-2026-55619: Parser Denial of Service via Deeply Nested Parentheses in E-mail Headers
A denial of service vulnerability in GOVCERT-LU eml_parser before version 3.0.2 allows unauthenticated remote attackers to trigger an unhandled RecursionError exception. The issue arises during the parsing of structured email headers containing excessively nested parentheses representing Comments and Folding White Space (CFWS). Because the parser fails to catch this recursion-limit exception from Python's standard library, processing of the entire mail immediately aborts, which can disrupt automated security triage pipelines and email ingestion components.
1 views•6 min read
•about 1 hour ago•CVE-2026-55620
7.5CVE-2026-55620: Algorithmic Complexity Denial of Service in GOVCERT-LU eml_parser
Prior to version 3.0.2, GOVCERT-LU's eml_parser library is vulnerable to an algorithmic complexity Denial of Service (DoS) vulnerability via the comment-stripping routine noparenthesis() in routing.py. An unauthenticated attacker can submit a crafted EML file containing nested parenthesized comments to cause complete CPU saturation. This happens due to a quadratic time complexity bottleneck in regex replacement of nested structures.
3 views•6 min read
•about 2 hours ago•CVE-2026-55629
8.7CVE-2026-55629: Arbitrary File Read via Path Traversal in Whistle Proxy Internal Service
Whistle prior to version 2.10.3 contains a path traversal vulnerability in its internal service layer. An unauthenticated remote attacker can read arbitrary files on the hosting operating system by issuing a crafted GET request containing relative or absolute file paths to the `/cgi-bin/temp/get` endpoint. This behavior occurs because the application fails open when an input file parameter does not match the temporary file format regex.
4 views•6 min read
•about 3 hours ago•CVE-2026-55609
7.1CVE-2026-55609: Arbitrary File Read and Write via Model Context Protocol (MCP) Tools in sublinear-time-solver and consciousness-explorer
An arbitrary file read and write vulnerability exists in the Model Context Protocol (MCP) server endpoints of sublinear-time-solver and consciousness-explorer. By providing unvalidated file paths to the export_state, import_state, saveVectorToFile, and loadVectorFromFile tools, local attackers can read or overwrite sensitive host files.
3 views•5 min read
•about 4 hours ago•CVE-2026-55604
8.6CVE-2026-55604: Authorization Bypass via Global Session Singleton in @arikusi/deepseek-mcp-server
An Authorization Bypass Through User-Controlled Key (CWE-639 / Insecure Direct Object Reference) vulnerability exists in @arikusi/deepseek-mcp-server starting in version 1.4.2 and fixed in 1.7.0. In Streamable HTTP transport mode, a process-global SessionStore singleton allows any remote client to retrieve or modify active conversation contexts belonging to other clients.
8 views•7 min read
•about 5 hours ago•CVE-2026-45018
9.8CVE-2026-45018: Unauthenticated Remote Code Execution via MCP stdio Transport in Chainlit
CVE-2026-45018 is a critical command injection vulnerability in Chainlit's Model Context Protocol (MCP) stdio transport backend. By submitting a crafted JSON payload containing dangerous argument options to an unauthenticated HTTP endpoint, a remote attacker can bypass executable validation rules and run arbitrary shell commands with the privileges of the active Python process.
6 views•10 min read
•about 6 hours ago•CVE-2026-45019
7.2CVE-2026-45019: Server-Side Request Forgery (SSRF) in Chainlit MCP Endpoint
An unauthenticated server-side request forgery (SSRF) vulnerability exists in Chainlit versions >= 2.4.0rc0 and < 2.12.0 when the Model Context Protocol (MCP) features are enabled. This vulnerability allows remote, unauthenticated attackers to force the backend application server to initiate arbitrary HTTP/HTTPS connections to internal subnets, localhost endpoints, or cloud metadata infrastructure.
6 views•6 min read
•about 7 hours ago•CVE-2026-55099
7.5CVE-2026-55099: Algorithmic Complexity Denial of Service in icalendar Component Equality
An algorithmic complexity denial of service vulnerability exists in the Python icalendar library's component equality evaluation. Due to recursive nested comparisons inside list membership operations, parsing and validating calendar components with deep nesting triggers exponential execution time, blocking application threads and consuming 100% of the available CPU core.
12 views•8 min read
•about 8 hours ago•CVE-2026-54338
5.3CVE-2026-54338: JupyterHub Unauthenticated Denial of Service via Unbounded Username Logging
JupyterHub is vulnerable to an unauthenticated Denial of Service (DoS) vulnerability. Prior to version 5.5.0, form-based authenticators failed to restrict the size of the username input field on failed logins, allowing remote attackers to exhaust host storage and memory resources.
3 views•11 min read
•about 9 hours ago•CVE-2026-55605
5.3CVE-2026-55605: Missing Authentication in @arikusi/deepseek-mcp-server HTTP Transport Endpoint
The self-hosted HTTP transport mode of @arikusi/deepseek-mcp-server (an MCP server for DeepSeek V4) exposes its JSON-RPC endpoint (POST /mcp) without authentication in versions 1.4.2 through 1.7.0. Unauthenticated clients can establish Model Context Protocol sessions and invoke tools, consuming the host's configured DeepSeek API key.
9 views•6 min read
•about 10 hours ago•GHSA-VWF3-4XXJ-QG6H
9.8GHSA-VWF3-4XXJ-QG6H: Server-Side Template Injection in mcp-contextforge-gateway
A Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) was discovered in the mcp-contextforge-gateway package before version 1.0.0. The vulnerability stems from an unsandboxed Jinja2 template rendering environment combined with an unsafe fallback mechanism using Python's native str.format() function. Attackers with template modification access could bypass static regex filters to execute arbitrary commands on the hosting platform.
5 views•7 min read
•about 11 hours ago•CVE-2026-55596
8.7CVE-2026-55596: DOM-based Cross-Site Scripting (XSS) in Plate Media Embed Component
CVE-2026-55596 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Plate rich-text editor framework (specifically within the @platejs/media package). The issue stems from an optimization fast-path that short-circuits safety parsing if a provider or source URL is already declared on an element. Consequently, serialized documents carrying malicious javascript: URLs bypass protocol sanitization and are loaded directly into iframe elements, leading to code execution.
5 views•6 min read