The vulnerability of the GlancesXMLRPCCHandler() and GlancesXMLRPCServer() classes in the glances/server.py file of the Glances monitoring tool’s application programming interface allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the GlancesXMLRPCHandler and GlancesXMLRPCServer methods in the glances/server.py file of the Glances monitoring tool’s application programming interface is related to a deficiency in the source verification mechanism. Exploiting this vulnerability could allow an attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-81841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shar...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

Characterizing Security Effects of OSS Vulnerabilities in Agent Systems

Software agents increasingly depend on open-source components when executing tools and interacting with external systems. Security flaws in these dependencies may therefore influence more than the software process in which they occur: their consequences can be carried through tool outputs, agent...

web-check v2.3.0

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: NinjaPear API to get a full B2B profiles from any URL | Hostinger Deploy Web-Check with one click on Hostinger | Warp Built for coding with multiple AI agents ---|---|--- Contents About...

Karma Pro 0.13

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

Fedora 43 : buildstream (2026-e14ea5695c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e14ea5695c advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...

Fedora 44 : buildstream (2026-ccf62cb9b3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ccf62cb9b3 advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CLEANSTART-2026-MP17411 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

Security vulnerability affects the consul package. Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped...

CVE-2026-94485: Origin Validation Error

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

Grafana Labs 11.6.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Missing Authorization (CVE-2026-81841)

The version of Grafana Labs installed on the remote host is 11.6.x through 12.4.x prior to 12.4.12, or 13.0.x prior to 13.0.10, or 13.1.x prior to 13.1.7, or 13.2.x prior to 13.2.3. It is, therefore, affected by a missing authorization vulnerability: - Pausing a shared public dashboard did not...

PT-2026-104378

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.0 through 16.3.7 Description The development server in this React framework for building full-stack web applications exposes a Model Context Protocol endpoint that does not reliably restrict cross-site requests. This allo...

Fedora 45 : buildstream (2026-d77557766a)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d77557766a advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...

Give yourself room to be human

Welcome to this week's edition of the Threat Source newsletter. Fall is officially here in Maryland, and I can't be more relieved. I flourish in 50 degree weather, where it feels natural to burrow under blankets, knit sweaters, and listen to an audiobook. Beyond that, though, can I say that I'm...

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...

BIT-AUTHENTIK-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

BIT-AUTHENTIK-2026-94612 authentik: Authentication bypass via assertion confusion in SAML sources

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that...

CLEANSTART-2024-UG11230 WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support

Security vulnerability affects the exempi package. The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBPSupport...