CVE-2026-10264

LowCVSS 3.5/10Last modified Jul 22, 2026

Description

A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessageRequest of the file whatsapp-bridge/main.go of the component Send API Endpoint. This manipulation of the argument mediaPath causes path traversal. The exploit has been publicly disclosed and may be utilized. Patch name: 6657cdceadd361e8fbe824afe9d00b4504009a5d. It is recommended to apply a patch to fix this issue.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

VendorProductVersions
lharrieswhatsapp-mcp0.0.1

References

Timeline

Published
Jun 1, 2026
Last modified
Jul 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1026438.8AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asynCVE-2026-1026499.9Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned CVE-2026-102656.3A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the fiCVE-2026-1026507.5Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticatCVE-2026-1026577.5esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler staticCVE-2026-1026634.3OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware CVE-2026-1026647.1ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/mCVE-2026-1026666.5The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST APCVE-2026-1026678.3Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permiCVE-2026-1026685.3The Joyland AI app accepts any TLS certificates from any server without validation.CVE-2026-1026695.3Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.CVE-2026-102673.3A security flaw has been discovered in janet-lang janet up to 1.41.0. This affects the function doframe of the file src/core/debug.c. Perfor