Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
54 matching advisories · 30 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium6.5
CVE-2026-110189

IBM ContextForge MCP Gateway is affected by a denial of service due to an incomplete list of disallowed jq inputs

IBM ContextForge MCP Gateway 1.0.8 through 1.0.11, and v1.1.0 is vulnerable to denial of service due to an incomplete denylist in the jq filter guard module (CWE-184). An authenticated remote attacker can supply a crafted jsonpath_filter value containing halt, halt_error, or unbounded-loop built-ins that bypass the safety check, causing gateway worker process termination or sustained resource exhaustion.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · ContextForge MCP Gateway
high8.6
CVE-2026-129099

Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration Import

Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Shenzhen Cudy Technology Co., Ltd. · TR3000 1.0
high8.8
CVE-2026-126370

Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save

Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

givanz · Vvveb
critical9.2
CVE-2026-128046

OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options

OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

OpenMage · magento-lts / OpenMage · magento-lts
low2.3
CVE-2026-126361Package fixes recorded

Astro: XSS via attribute injection in dynamic tag names

When a dynamic tag (const Tag = ...; <Tag />) resolves to a string, Astro renders it as a raw HTML element name. The name was filtered to remove characters that could inject attributes, but the filter did not handle /. Because HTML parsers treat / inside a tag as an attribute separator, a tag name such as img/src/onerror=alert(1) was rendered as an <img> element with an onerror attribute. The JSX renderer used for MDX did not filter string tag names at all.

Recorded fixes — astro: 7.4.5. Check your release branch.

Exploitation not established

npm / astro
medium5.3
GHSA-p9wj-w8xq-vjx6Package fixes recorded

Loofah allowed_uri? treats javascript&#x3a alert(1) as safe

Loofah::HTML5::Scrub.allowed_uri? returns true for a javascript: or vbscript: URI whose scheme is split by a numeric character reference without a trailing semicolon, followed by a character that allowed_uri? strips, such as a space or tab. A browser ends the reference at that character and reads javascript&#x3a alert(1) as javascript: alert(1).

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
medium4.7
GHSA-m3x9-938q-5767Package fixes recorded

Loofah: CSS url() sanitization bypass via escaped parentheses

Loofah::HTML5::Scrub.scrub_css rejected any property whose top-level Crass tokens included a :url or :bad_url, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrub_css rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
medium5.3
GHSA-jcff-cj73-4w4fPackage fixes recorded

Loofah allowed_uri? treats data:text&sol;html as safe text/plain

Loofah::HTML5::Scrub.allowed_uri? returns true for a data: URI whose mediatype is written with the HTML5 named character reference &sol; in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed text/plain, while a browser decodes the reference and reads the same URI as text/html.

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
medium5.3
CVE-2026-126933

Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch

Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

diced · zipline
high8.8
CVE-2026-121663

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Visual Studio Code
high7.8
CVE-2026-121661

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Visual Studio Code
high7.5
CVE-2026-121660

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Visual Studio Code
critical9.4
CVE-2026-63011

GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is passed without restriction to TemplateParser::parse(). When the template contains an [assign] block whose expression includes a {{...}} variable reference, the engine calls eval() on the expanded expression after running it through a validateExpression() guard. The guard double-quotes unrecognized tokens, but PHP 7+ allows a string enclosed in parentheses to be invoked as a function ("system")("id") is valid PHP and calls system("id"). A single authenticated HTTP request is sufficient to execute arbitrary OS commands as the web server user (www-data). This issue has been patched in versions 6.8.167, 25.0.102, and 26.0.27.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Intermesh · groupoffice
high7.7
CVE-2026-125368

OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command Allowlist

OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that treats any command starting with find as safe without inspecting -execdir arguments. Prompt-injected agents can run find with -execdir to invoke binaries like dd, nc, perl or openssl through an unsandboxed shell, overwriting files or executing code without human approval.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

YeQing17-2026 · OmniAgent
critical9.9
CVE-2026-17150

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code and access sensitive information from other tenants due to insufficient input validation. Uploaded custom module content is not sufficiently validated before it is processed, which could allow code to run with access beyond the user's own tenant.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · API Connect
medium4.6
CVE-2026-69128

Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap)

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

chartbrew · chartbrew
medium4.4
CVE-2026-123876

Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Public exploit reference

Red Hat · Red Hat Hardened Images / Red Hat · Red Hat Enterprise Linux 10
high8.8
CVE-2026-123783

Skyvern through 1.0.56 Script Sandbox Bypass via types.CodeType Bytecode

Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by reconstructing functions from raw bytecode with types.CodeType. Attackers can deploy scripts that evade the is_safe_script_code AST denylist and import blocked modules such as subprocess or socket to run code in the Skyvern server process.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Skyvern-AI · skyvern
high8.8
CVE-2026-113663Some package fixes recorded

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

SandboxShellTool's restricted modes — allowed=[...] (explicit command allowlist) and readonly=True (implicit READONLY_COMMANDS allowlist) — can both be bypassed by embedding a newline character inside the command string. The filter only inspects a single-line set of shell metacharacters, but execution runs the raw string through sh -c, where a shell treats an embedded newline exactly like a ; statement separator. An agent (or content that steers the agent, e.g. via prompt injection) can therefore run arbitrary shell commands even when the tool was configured to allow only a specific command prefix or only read-only commands. With the default LocalEnvironment() backend this is a real host subprocess (its own docstring: "Commands run via subprocess on the host, so there is no real isolation"), not an isolated container, so this is full host command execution, not merely an escape from an already-sandboxed environment.

Recorded fixes — ag2: 1.1.1. Check your release branch.

Exploitation not established

PyPI / ag2PyPI / autogen
medium5.4
CVE-2026-121949

Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or allowMediaHosts() to bypass it, so that browsers load images from disallowed hosts in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.The srcset attribute on img and source elements and the imagesrcset attribute on link elements are allowed by the sanitizer, but their URL candidates are never validated, so their values are kept verbatim while the same URL in src is dropped. The fixes for CVE-2026-45753 and CVE-2026-48761 extended the same attribute list but did not cover these two attributes. For example, with allowMediaSchemes(['https']) and allowMediaHosts(['trusted.example']), <img srcset="https://evil.example/a.png 1x"> survives sanitization, and the browser fetches the selected candidate as it would fetch src. Candidates with a scheme forbidden by the configuration, such as http, are kept as well. Any application that sanitizes untrusted HTML and relies on the media schemes and hosts allowlists to restrict where images can be loaded from is affected. A single crafted value is enough to make the browser of a user viewing the sanitized content send a request to an attacker-controlled host, which can be used to track viewers or log their IP addresses. No authentication is needed if the application accepts HTML from unauthenticated users.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

sensiolabs · symfony
medium4.3
CVE-2026-118517

Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)

The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts() and allowMediaHosts() checks to be bypassed for URLs without a well-formed authority, resulting in untrusted hosts being referenced in sanitized output in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

sensiolabs · symfony
medium6.5
CVE-2026-123125

Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

sensiolabs · symfony
low3.1
CVE-2026-119567

vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

vsftpd · vsftpd
high8.8
CVE-2026-96196

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Microsoft Edge (Chromium-based)
high7.5
CVE-2026-116339

iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

iFlytek · astron-agent
medium6.4
CVE-2026-115845

Incomplete validation in the run_script Python sandbox in AWS MCP Server

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

AWS · AWS MCP Server
medium6.3
CVE-2026-115751

mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

agentfront · mcp-from-openapi
critical9.1
GHSA-7vr2-2fgp-9w7pPackage fixes recorded

Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

OctKey.import_key() carries the only guard that stops an asymmetric public key from being used as an HMAC secret in authlib.jose. That guard is raw_key.startswith(POSSIBLE_UNSAFE_KEYS) — anchored at byte 0 — while the loader that consumes the identical bytes on the asymmetric path (cryptography.hazmat.primitives.serialization.load_pem_public_key / load_pem_x509_certificate) skips anything before the -----BEGIN line. A PEM public key or X.509 certificate carrying one leading byte — a newline, a space, four spaces of indentation, a UTF-8 BOM, or a comment line — is therefore not recognised, falls through, and becomes the HMAC secret. An attacker holding only the issuer's public key then mints an HS256 token with arbitrary claims that jwt.decode() accepts as authentic.

Recorded fixes — authlib: 1.9.0. Check your release branch.

Public exploit reference

PyPI / authlib