CVE Notifier

CVE-2026-55837 CWE-200 6.8

dbt-mcp: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation…

cve.org dbt-labs:dbt-mcp 14 Sep 2026

CVE-2026-55073 CWE-918 6.2

WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction b…

cve.org Kozea:WeasyPrint 14 Sep 2026

CVE-2026-57579 CWE-862 7.5

Alchemy: Unauthenticated nested page API leaks restricted & unpublished content

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nest…

cve.org AlchemyCMS:alchemy_cms 14 Sep 2026

CVE-2026-55416 CWE-89 8.8

Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from,…

cve.org pimcore:pimcore 14 Sep 2026

CVE-2026-55072 CWE-20 8.5

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressi…

cve.org pimcore:pimcore 14 Sep 2026

CVE-2026-55451 CWE-1321 N/A

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists o…

cve.org locize:gettext-converter 14 Sep 2026

CVE-2026-90803 CWE-120 5.3

GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow

A security vulnerability has been detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_64_relocate_section of the file bfd/elf64-x86-64.c of the component ld. Such manipulation of the arg…

cve.org GNU:Binutils 14 Sep 2026

CVE-2026-90802 CWE-476 4.4

GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference

A weakness has been identified in GNU Binutils 2.47. Affected is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. This manipulation causes null pointer dereference. The attack requires local access. …

cve.org GNU:Binutils 14 Sep 2026

CVE-2026-90801 CWE-120 5.3

GNU Binutils ld cache.c cache_bwrite buffer overflow

A security flaw has been discovered in GNU Binutils 2.47. This impacts the function cache_bwrite of the file bfd/cache.c of the component ld. The manipulation of the argument nbytes results in buffer overflow. The attack…

cve.org GNU:Binutils 14 Sep 2026

CVE-2026-54452 CWE-918 N/A

safeurl: Missing IPv6 CIDR Ranges in Blocklist

safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables I…

cve.org doyensec:safeurl 14 Sep 2026

CVE-2026-15923 CWE-835 4.6

Infinite loop denial of service in Zephyr SDIO byte-I/O from a card-supplied zero max_blk_size

The Zephyr SDIO subsystem function sdio_io_rw_extended_helper() in subsys/sd/sdio.c finishes transfers with a byte-I/O loop that uses size = MIN(remaining, func->cis.max_blk_size) as the per-iteration step. The value fun…

cve.org zephyrproject:zephyr 14 Sep 2026

CVE-2026-53496 CWE-248 5.3

ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso…

cve.org mattiasw:ExifReader 14 Sep 2026