CVE-2026-67179 Genkit improper host header validation

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

CVE-2026-67179

Genkit’s Dev UI server (default port 4000) suffers from improper validation of host request headers, enabling DNS rebinding to reach POST /api/runAction from any host on the developer’s network or any site the developer visits. This allows an attacker to execute any registered Genkit action and r...

Duplicate Advisory: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7c4v-fwgw-9rf7. This link is maintained to preserve external references. Original Description Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development...

CVE-2026-72744

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

CVE-2026-72744

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

CVE-2026-72744

Nuxt.js development server vulnerability (CVE-2026-72744) affects Nuxt versions 4.4.7–4.5.0 and 3.21.7–3.21.9. The Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json) trusts the Host header to determine local requests, allowing unauthenticated LAN attackers ...

EUVD-2026-56134

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

Important: Red Hat Security Advisory: host-metering security update

An update for host-metering is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Injection fast-uri Dependency in Bitbucket Data Center

This High severity Injection vulnerability was introduced in version 9.4.12 of Bitbucket Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated attacker to modify the actions taken by a system...

CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

Linux Distros Unpatched Vulnerability : CVE-2026-71287

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits,...

Linux Distros Unpatched Vulnerability : CVE-2026-68239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/ttm: Account for NULL and handle pages in ttmpoolbackup Pages in ttmpoolbackup can be NULL or backup handles ttmbackuppageptrishandle, neither of which can ...

Apache Tomcat 9.0.13 < 9.0.117 Insertion of Sensitive Information Vulnerability

The version of Tomcat installed on the remote host is 9.0.13 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering...

PT-2026-70063

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description An out-of-bounds write exists in the USB device-side CDC NCM class control-to-host handler usbd cdc ncm cth within the subsys/usb/device next/class/usbd cdc ncm.c file. The issue occurs when t...

PT-2026-70157

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...