EUVD-2026-64745

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2026-81691

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

PYSEC-2026-3797

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81102

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...

CVE-2026-81093

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

CVE-2026-78251

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter

Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...

Malicious code in sap-quarterly-report (PyPI)

Source: kam193 2235bdf8263c08fede094c665d2fbc4e023a0f0c5e99631d70ae0685567b37ec During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-ekx-report-util...

EUVD-2026-67047

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81093

Apify Actors MCP Server before version 0.9.12 is vulnerable to Server-Side Request Forgery (SSRF) via the get-html-skeleton tool. The URL validation function (isValidHttpUrl) in src/utils/generic.ts confirmed only that the argument began with an http/https scheme and parsed as a URL, without insp...

CVE-2026-81093 Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

MAL-2026-14556 Malicious code in sap-quarterly-report (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2235bdf8263c08fede094c665d2fbc4e023a0f0c5e99631d70ae0685567b37ec During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

CVE-2026-71211

A flaw was found in MLflow's AI Gateway where an unvalidated apibase value in a gateway secret could lead to a Server-Side Request Forgery SSRF vulnerability. An authenticated user, even with read-only privileges, can create a secret with an internal network address. This allows the gateway proxy...

curl: 41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

Summary When curl is launched with stdin fd 0 and stderr fd 2 closed, maincheckfds in src/toolmain.c can assign opposite ends of the same pipe to fd 0 and fd 2. In verbose mode with a stdin-based upload through an authenticated proxy, the Proxy-Authorization header written to stderr becomes...

Exploit for CVE-2026-18963

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detecto...

curl: 18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface Summary When a proxy is configured with a literal link-local IPv6 address and an explicit zone ID e.g. http://fe80::1%25eth0:8080, curl parses and stores the zone correctly but never applies it to the socket...

EUVD-2026-66762

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...

CVE-2026-78251: Use of Hard-coded Credentials

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2026-81528: Improper Neutralization of Special Elements in Data Query Logic

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...

CVE-2026-81102: Origin Validation Error

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcpserverdash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback...