CVE-2026-13318 Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip

A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...

CVE-2026-13318

KubeVirt exposes an SSRF in virt-api port-forward: when handling a port-forward to a VirtualMachineInstance, virt-api reads vmi.Status.Interfaces[0].IP and dials it without validation. For VMIs using non-masquerade networks (bridge or secondary-only), this IP is supplied by the in-guest QEMU agen...

GO-2026-5717 free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef

free5GC's NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path in github.com/free5gc/nef...

GO-2026-5673 Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover in github.com/free5gc/amf

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover in github.com/free5gc/amf...

GO-2026-5647 free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri) in github.com/free5gc/nef

free5GC's NEF crashes via logger.Fatal on PFD notification delivery failure attacker-controlled notifyUri in github.com/free5gc/nef...

GO-2026-5607 MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry

MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry...

GO-2026-5447 free5GC's NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef

free5GC's NEF 3gpp-pfd-management PATCH applications/appId panics on UDR access failure due to nil ProblemDetails dereference in github.com/free5gc/nef...

Malicious code in gx-npm-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e919710d2f28ec776b8165821ebe2fbe480c1e432ec9416c7b73bd1315ee6a6e Package published at version 99.99.99 under a generic name gx-npm-lib — the canonical dependency-confusion shape used to overshadow internal packages...

GHSA-54VG-PFH7-JQ95 Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF

Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...

CVE-2026-40983

A flaw was found in Micrometer. A remote attacker can provide specially crafted gRPC gRPC Remote Procedure Call requests, which may lead to a denial-of-service DoS condition. This vulnerability allows an attacker to disrupt the availability of the affected system. Mitigation To mitigate this issu...

CVE-2026-56771

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

CVE-2026-56779

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56766

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an...

MAL-2026-6471 Malicious code in tailwind-color-shades (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd681005962f5628f4394450bae9430992e58159e3256bb4af2bc156c5c1fc5 The package's documented entry point index.ts begins with import './src/bootstrap';, which causes src/bootstrap.js to run whenever the module is...

GO-2026-5326 free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef

free5GC's NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler in github.com/free5gc/nef...

GO-2026-5317 Tilt: Missing authentication on the network-exposed Tilt HUD server in github.com/tilt-dev/tilt

Tilt: Missing authentication on the network-exposed Tilt HUD server in github.com/tilt-dev/tilt...

GO-2026-5093 free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef

free5GC's NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions in github.com/free5gc/nef...

GO-2026-5142 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions in github.com/free5gc/nef

free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions in github.com/free5gc/nef...

GO-2026-5072 Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows

Argo has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure in github.com/argoproj/argo-workflows...

CVE-2026-53003

A flaw was found in the Linux kernel's Point-to-Point Protocol over Ethernet PPPoE driver. A remote attacker or a peer with a misconfigured implementation could send specially crafted Protocol Field Compression PFC frames. This could lead to a one-byte shift in the PPP payload, causing a four-byt...