CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-54689

CVE-2026-54689 affects mcp-searxng , a Model Context Protocol (MCP) server providing AI assistants with web search and URL-reading via SearXNG. The vulnerability lies in the hardened-mode SSRF protection in src/url-reader.ts: when MCP_HTTP_HARDEN is enabled and private URLs are not explicitly all...

CVE-2026-54689 mcp-searxng hardened-mode SSRF bypasses permit internal URL access

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

CVE-2026-56827 Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

EUVD-2026-78914

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56829

Shopper (a headless e-commerce admin panel) prior to 2.9.2 has an authorization bypass in the Livewire VariantStock component. The stockAction() method lacks an edit_product_variants permission check, and the public $variant property is missing the #[Locked] attribute, making it client-mutable vi...

EUVD-2026-78913

Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edituserproperties permissions on the REST API user write endpoints PUT /ccm/api/1.0/users/uID and POST /ccm/api/1.0/users/uID/changepassword. A user with an update-scoped OAuth token and permission to edit only one non-sensitive field could...

CVE-2026-56825

Shopper (a headless e-commerce admin panel) is vulnerable to an authorization bypass in the CollectionProducts Livewire component prior to v2.9.2 . Two defects combine: the per-record and bulk delete actions lack an ->authorize(...) guard, and the public $collection property is not marked #[Lo...

CVE-2026-12910 Missing Authentication for Critical Function in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing...

EUVD-2026-78909

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing...

CVE-2026-12910

CVE-2026-12910 is a missing authentication enforcement issue in GitLab CE/EE affecting versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 . Under certain conditions, an authenticated user could bypass SAML SSO sign-in restrictions and authenticate without SSO due to miss...

EUVD-2026-78898

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

CVE-2026-11918 IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures

IBM ContextForge MCP Gateway = v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content...

CVE-2026-11918

IBM ContextForge MCP Gateway (versions ≤ v1.0.4) is vulnerable to a security filter bypass in its regex_filter and deny_filter plugins. The root cause (CWE-184) is that these plugins' scanning loops only inspect top-level keys of payload.args without recursive traversal, allowing an authenticated...

CVE-2026-53459 Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

CVE-2026-53459

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. A fail-open flaw in the authentication code (introduced in version 0.1.6, fixed in 0.2.4.4) allows an unauthenticated, remote attacker to flood a public endpoint, exhausting resources until database access fa...

NetSec-CVE-2023-4357

网络安全项目 — CVE-2023-4357 概述 本项目是网络安全课程的期末项目。 该项目聚焦于 CVE-2023-4357，这是一个影响 116.0.5845.96 之前版本的 Google Chrome 的漏洞。该漏洞与 XML/XSLT 的处理有关，可能允许恶意文档绕过预期的文件访问限制。 复现 我在虚拟机中使用旧版 Google Chrome 复现了该漏洞，并分析了 XML 文档如何触发这一易受攻击的行为。 所提供的 XML/SVG 文件用于复现该漏洞，并演示对 /etc/passwd 的未授权访问。 环境 VirtualBox Google Chrome...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785

In Apptainer (open-source container platform) prior to v1.5.1 , the limit container paths directive in apptainer.conf uses plain string-prefix matching in Image.AuthorizedPath. This means an allowed path such as /data/safe also authorizes a sibling like /data/safe-but-unsafe, allowing a local use...