Все уязвимости

nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities

.NET Information Disclosure Vulnerability

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

pypdf: Unvalidated JPEG image data loading

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root

iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

Cross Site Scripting (XSS) vulnerability in SAPUI5

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

Security Policy Bypass in Forcepoint Security Engine (NGFW)

Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform ar

HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist

NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows

MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft

princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload

NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist