CVE-2026-19288

A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to path traversal. The attack needs to be performed locally. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-22

• https://github.com/astralisone/rive-mcp-server-core/
• https://github.com/astralisone/rive-mcp-server-core/issues/2
• https://vuldb.com/cve/CVE-2026-19288
• https://vuldb.com/submit/865239
• https://vuldb.com/vuln/387027
• https://vuldb.com/vuln/387027/cti
• https://github.com/astralisone/rive-mcp-server-core/issues/2

Published

Aug 8, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19282A weakness has been identified in andreahaku llm_memory_mcp …5.3
• CVE-2026-19283IBM Observability with Instana (Agent) Build 1.0.303 through…7.7
• CVE-2026-19284A security vulnerability has been detected in MauricioMilano…5.3
• CVE-2026-19285A vulnerability was detected in aaronsb memory-graph up to 5…5.3
• CVE-2026-19286IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote a…9.8
• CVE-2026-19287A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Aff…5.3
• CVE-2026-1929The Advanced Woo Labels plugin for WordPress is vulnerable t…8.8
• CVE-2026-19290IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6_1, 6.2.1.0…7.5
• CVE-2026-19291Bluetooth re-pairing with an existing device can use a lower…8.8
• CVE-2026-19292Re-pairing with a legitimate device can use a lower security…8.8
• CVE-2026-19293SMP security request (from peripheral) does not include the …8.8
• CVE-2026-19294IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote a…6.5