CVE-2026-46555

The CVE applies to WhatsApp MCP Server, where the whatsapp-bridge HTTP API on 127.0.0.1:8080 is unauthenticated and lacks Host header validation. The /api/send endpoint accepts an absolute media_path, enabling a local caller (including sibling MCP servers, IDE extensions, or other processes in th...

PT-2026-61552

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description A server-side request forgery SSRF issue exists in the JWKS fetcher. The system validates the URL hostname string against allow-lists but fails to verify the resolved IP addresses. An attacker with...

CVE-2026-50134

CVE-2026-50134 (Hugo) affects Hugo versions 0.91.0 through 0.161.1, where resources.GetRemote did not re-validate intermediate URLs on HTTP 3xx redirects despite enforcing security.http.urls on the initial URL. This allowed a redirect to an allowed host (or an attacker-controlled DNS/response) th...