Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 730 | 0,2 % |
| ≥50 % | 3.213 | 0,9 % |
| ≥10 % | 22.093 | 5,9 % |
| <10 % | 347.769 | 93,0 % |
PHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hosts
Cyfirma links PHP2Shell scans of 216 vulnerable hosts to a suspected North Korean campaign using AI to rank public exploits. On October 21, PHP released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619
CVE-2026-106931 When Someone Else Runs Your SiteGuard
CVE-2026-106931 When Someone Else Runs Your SiteGuard SiteGuard Server Edition is often installed by a hosting provider, a web agency or an internal platform team rather than by the security group that ends up answering for it. CVE-2026-106
[UPDATE] [mittel] docker: Schwachstelle ermöglicht Manipulation von Daten und Umgehen von Sicherheitsvorkehrungen
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in docker ausnutzen, um Daten zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen. Weiterlesen
Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Login Tokens Without Permissions
A high-severity vulnerability in Microsoft Authenticator for Android let a malicious app with no Android permissions steal authentication tokens for a victim’s signed-in work account, potentially exposing Microsoft 365 email, files, calenda
PHP-Schwachstelle: Sieben Experten warnen vor massiven Sicherheitslücken
Viele“, schrieb Shumer. „Wir stecken mitten im größten Moment für die Cybersicherheit seit Jahren.“ Laut Shumers Beitrag könnte Folgendes passieren:. Weiterlesen
HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow
The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. Th
CVE-2026-116229 | ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31 Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting
A vulnerability was found in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. It has been classified as problematic. Impacted is the function clipboard.readText of the file apps/electron/src/preload.ts of the component Renderer-Process IPC Br
CVE-2026-116228 | 777genius agent-teams-ai up to 2.17.10 Local HTTP Service HttpServer.ts doStart missing authentication
A vulnerability was found in 777genius agent-teams-ai up to 2.17.10 and classified as problematic. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The m
CVE-2026-116282 | Kameleo up to 5.3.1 Cookie Controller w.cs CookieController.ListCookies guid information disclosure
A vulnerability was found in Kameleo up to 5.3.1. It has been declared as problematic. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The ma
CVE-2026-116281 | Kameleo up to 5.0.1.26 Profile Controller t.cs ListProfiles information disclosure
A vulnerability was found in Kameleo up to 5.0.1.26. It has been classified as problematic. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The mani
Citrix NetScaler Zero-Day: 3 Wellen in 11 Tagen [2026] - shattered.io
Weitere Hintergründe zu Schwachstellen und Gegenmaßnahmen sammelt die Rubrik Cybersicherheit. Fünf Prognosen für die nächsten Wochen. Die folgenden ... Weiterlesen
CVE-2026-116280 | Kameleo up to 5.0.1.26 Proxy Validation f.cs InternalController.TestProxy host/port server-side request forgery
A vulnerability was found in Kameleo up to 5.0.1.26 and classified as problematic. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation
CVE-2026-116284 | Kameleo up to 5.3.1 Local API /general/user-info information disclosure
A vulnerability categorized as problematic has been discovered in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. Thi
Böswillige Admins können in Fortinet-Produkten beliebige Dateien löschen
Angreifer nutzen eine Path-Traversal-Sicherheitslücke in mehreren Fortinet-Produkten aus. Über kompromittierte Admin-Konten können sie damit beliebige Dateien manipulieren oder löschen. (Bild: ChubbyCat - stock.adobe.com / KI-generiert) Wei
BeyondTrust Sicherheitslücke: CVSS 9,3 aktiv [2026] - Tech Insider
BeyondTrust-Zero-Day: CVSS 9,3, seit August aktiv [2026]. Elias Virtanen; Oktober 26, 2026; Cybersicherheit · Elias ... Weiterlesen
CVE-2026-116123 | A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. I
CVE-2026-116122 | A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the
A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is poss
CVE-2026-116121 | A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is assessed as difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted earl
A vulnerability was identified in NocoDB up to 2026.08.0. This issue affects some unknown processing of the file users.service.ts of the component Registration. Such manipulation leads to race condition. The attack may be performed from rem
CVE-2026-116120 | A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The attack is considered to have high complexity. It is stated that the exploitability is difficult. Code-verified absence of in-app rate limiting on the una
A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the file /auth/user/signup of the component PublicApiLimiterGuard. This manipulation causes allocation
CVE-2026-116119 | A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack can be executed remotely. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
A vulnerability was found in NocoDB up to 2026.08.0. This affects an unknown part of the file packages/nocodb/src/services/users/users.service.ts of the component Password-Reset Flow. The manipulation results in race condition. The attack c
CVE-2026-113345 | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution.
Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application ma
CVE-2026-116118 | A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in Z.ai Zcode up to 3.14.3/3.15.1. Affected by this issue is some unknown functionality of the component Sed Command Filter. The manipulation leads to os command injection. Remote exploitation of the attack is
CVE-2026-116117 | A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path traversal. The attack may be launched remotely. The exploit has been published and may be used. T
A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultV
CVE-2026-116116 | A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be a
CVE-2026-116115 | A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The attack can only be initiated within the local network. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was co
A security vulnerability has been detected in Yoosee GM8135S Camera 21.00.01.36. This impacts an unknown function of the file wpa_supplicantX.conf of the component WiFi Configuration. Such manipulation leads to improper initialization. The
CVE-2026-116114 | A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The v
A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive in
CVE-2026-116113 | A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is poss
CVE-2026-4972 | code-projects Online Reviewer System up to 1.0 btn_functions.php description cross site scripting (EUVD-2026-16805)
A vulnerability categorized as problematic has been discovered in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /system/system/students/assessments/databank/btn_functions.php. Such manipulation
CVE-2026-4961 | Tenda AC6 15.03.05.16 POST Request /goform/QuickIndex formQuickIndex PPPOEPassword stack-based overflow
A vulnerability, which was classified as critical, has been found in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation
CVE-2026-34388 | fleetdm fleet up to 4.80.x RPC Launcher Endpoint improper check or handling of exceptional conditions (GHSA-w254-4hp5-7cvv)
A vulnerability categorized as problematic has been discovered in fleetdm fleet up to 4.80.x. Affected is an unknown function of the component RPC Launcher Endpoint. The manipulation results in improper check or handling of exceptional cond
CVE-2026-33882 | Statamic CMS up to 5.73.15/6.7.1 Markdown Preview Endpoint improper authentication (GHSA-cvh3-23vq-w7h4)
A vulnerability classified as critical was found in Statamic CMS up to 5.73.15/6.7.1. Affected by this vulnerability is an unknown functionality of the component Markdown Preview Endpoint. Executing a manipulation can lead to improper authe
CVE-2026-33874 | Gematik app-Authenticator up to 4.15.x on macOS File os command injection (GHSA-mjgm-7hwc-qqcr)
A vulnerability was found in Gematik app-Authenticator up to 4.15.x on macOS. It has been rated as critical. This issue affects some unknown processing of the component File Handler. Performing a manipulation results in os command injection
CVE-2026-26060 | fleetdm fleet up to 4.80.x Password Reset Token session expiration (GHSA-3458-r943-hmx4)
A vulnerability was found in fleetdm fleet up to 4.80.x. It has been declared as critical. This affects an unknown function of the component Password Reset Token Handler. Executing a manipulation can lead to session expiration. This vulnera
CVE-2026-116112 | A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version detai
A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec le
CVE-2026-116111 | A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in 2K Games Civilization V 1.0.3.144. Impacted is the function loadstring of the component Lua Sandbox. Executing a manipulation can lead to type confusion. The attack may be performed from remote. The exploit
CVE-2026-90197 | Linux Kernel up to 6.18.51/7.2.5 HID haptic fill_effect_buf uninitialized variable (WID-SEC-2026-3444)
A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.18.51/7.2.5. Affected by this issue is the function fill_effect_buf of the component HID haptic. The manipulation leads to use of uninitialized v
CVE-2026-90196 | Linux Kernel up to 7.2.5 SOF integer overflow (WID-SEC-2026-3444)
A vulnerability classified as problematic was found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. Affected by this vulnerability is an unknown functionality of the component SOF. Executing a manipulation can lead to integer
CVE-2026-90195 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 BPF JIT input validation (WID-SEC-2026-3444)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. This impacts an unknown function of the component BPF JIT. Performing a manipulation results in improper input validation. This
CVE-2026-90194 | Linux Kernel up to 7.2.5 ACPI acpi_device_cleanup allocation of resources (WID-SEC-2026-3444)
A vulnerability classified as critical has been found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. Affected is the function acpi_device_cleanup of the component ACPI. Performing a manipulation results in allocation of resou
CVE-2026-90193 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 qcom-cpucp qcom_cpucp_mbox_irq_fn deadlock (WID-SEC-2026-3444)
A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. This affects the function qcom_cpucp_mbox_irq_fn of the component qcom-cpucp. The manipulation results in deadlock. This vulnerabilit
CVE-2026-90192 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 qcom-cpucp qcom_cpucp_mbox_send_data null pointer dereference (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. It has been declared as critical. This vulnerability affects the function qcom_cpucp_mbox_send_data of the component qcom-cpucp. Such manipulation leads to null pointer
CVE-2026-90191 | Linux Kernel up to 6.18.51/7.2.5 mailbox buffer over-read (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 6.18.51/7.2.5. It has been classified as critical. This affects an unknown part of the component mailbox. This manipulation causes buffer over-read. This vulnerability is registered as CVE-202
CVE-2026-90190 | Linux Kernel up to 7.2.5 null_blk null_init race condition (WID-SEC-2026-3444)
A vulnerability described as problematic has been identified in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. This impacts the function null_init of the component null_blk. Such manipulation leads to race condition. This vulner
CVE-2026-90189 | Linux Kernel up to 7.2.5 null_blk block/genhd.c null_init use after free (WID-SEC-2026-3444)
A vulnerability classified as critical was found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. This affects the function null_init of the file block/genhd.c of the component null_blk. Such manipulation leads to use after fre
CVE-2026-90188 | Linux Kernel up to 7.2.5 null_blk null_setup_tagset allocation of resources (WID-SEC-2026-3444)
A vulnerability marked as very critical has been reported in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. This affects the function null_setup_tagset of the component null_blk. This manipulation causes allocation of resources.
CVE-2026-90187 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 null_blk null_del_dev memory leak (WID-SEC-2026-3444)
A vulnerability labeled as problematic has been found in Linux Kernel up to 6.12.109/6.18.51/7.2.5. The impacted element is the function null_del_dev of the component null_blk. The manipulation results in memory leak. This vulnerability is
CVE-2026-116110 | A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this
A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentic
CVE-2026-90186 | Linux Kernel up to 7.2.5 null_blk main.c nullb_update_nr_hw_queues null pointer dereference (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5 and classified as problematic. Affected by this issue is the function nullb_update_nr_hw_queues of the file drivers/block/null_blk/main.c of the componen
CVE-2026-90185 | Linux Kernel up to 7.2.5 null_blk power_store race condition (WID-SEC-2026-3444)
A vulnerability has been found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5 and classified as critical. Affected by this vulnerability is the function power_store of the component null_blk. The manipulation leads to race con
CVE-2026-90184 | Linux Kernel up to 7.2.5 null_blk block/blk-zoned.c nullb_device_power_store zoned/zones race condition (WID-SEC-2026-3444)
A vulnerability classified as problematic has been found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. The impacted element is the function nullb_device_power_store of the file block/blk-zoned.c of the component null_blk. Th
CVE-2026-90183 | Linux Kernel up to 7.2.5 blk-iolatency iolatency_pd_free use_delay/congestion_count denial of service (WID-SEC-2026-3444)
A vulnerability identified as critical has been detected in Linux Kernel up to 7.2.5. The affected element is the function iolatency_pd_free of the component blk-iolatency. The manipulation of the argument use_delay/congestion_count leads t
CVE-2026-90182 | Linux Kernel up to 7.2.5 blk-iocost ioc_pd_free race condition (WID-SEC-2026-3444)
A vulnerability categorized as problematic has been discovered in Linux Kernel up to 7.2.5. Impacted is the function ioc_pd_free of the component blk-iocost. Executing a manipulation can lead to race condition. This vulnerability appears as
CVE-2026-90181 | Linux Kernel up to 7.2.5 ublk __ublk_shmem_remove_ranges infinite loop (WID-SEC-2026-3444)
A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.2.5. Affected is the function __ublk_shmem_remove_ranges of the component ublk. Executing a manipulation can lead to infinite loop. This vulnerability i
CVE-2026-90180 | Linux Kernel up to 7.2.5 block mtip_hw_ioctl use after free (WID-SEC-2026-3444)
A vulnerability was found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. It has been rated as very critical. This issue affects the function mtip_hw_ioctl of the component block. Performing a manipulation results in use after
CVE-2026-90179 | Linux Kernel up to 6.18.51/7.2.5 AppArmor change_hat deadlock (WID-SEC-2026-3444)
A vulnerability described as critical has been identified in Linux Kernel up to 6.18.51/7.2.5. The affected element is the function change_hat of the component AppArmor. The manipulation results in deadlock. This vulnerability was named CVE
CVE-2026-90178 | Linux Kernel up to 6.12.109/6.18.51/7.2.5 hwmon coretemp_device_remove allocation of resources (WID-SEC-2026-3444)
A vulnerability identified as problematic has been detected in Linux Kernel up to 6.12.109/6.18.51/7.2.5. This vulnerability affects the function coretemp_device_remove of the component hwmon. Performing a manipulation results in allocation
CVE-2026-90177 | Linux Kernel up to 7.2.5 bpf input validation (WID-SEC-2026-3444)
A vulnerability categorized as very critical has been discovered in Linux Kernel up to 7.2.5. This affects an unknown part of the component bpf. Such manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-
CVE-2026-90176 | Linux Kernel up to 7.2.5 ksmbd check_lock_range locking (WID-SEC-2026-3444)
A vulnerability classified as very critical was found in Linux Kernel up to 6.1.187/6.6.156/6.12.109/6.18.51/7.2.5. Impacted is the function check_lock_range of the component ksmbd. The manipulation results in improper locking. This vulnera
CVE-2026-116109 | A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability has been found in continuedev Continue 2.0.0. This vulnerability affects the function MCPManagerSingleton.setConnections of the file core/config/ConfigHandler.ts of the component MCP Server Transport. Such manipulation leads
CVE-2026-116108 | A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access co