CVE-2026-69351

Windows Universal Plug and Play (UPnP) Device Host contains an information disclosure vulnerability that allows a locally authenticated attacker with low privileges to expose private personal information without user interaction. The CVSS v3.1 score is 5.5 (Medium) with a high confidentiality imp...

Insufficiently Protected Credentials

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the WORKLOADIDENTITY authenticator through AuthByWorkloadIdentity.prepare in src/snowflake/connector/auth/workloadidentity.py. An...

CVE-2026-68830

CVE-2026-68830 is an information disclosure vulnerability in Windows Universal Plug and Play (UPnP) Device Host , caused by improper link resolution before file access ('link following'). An authorized local attacker (low privileges, no user interaction) can exploit this to disclose information, ...

EUVD-2026-73192

Improper link resolution before file access 'link following' in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

@ai-thinker/deepseek-harness-cli (>=0.3.7, <=0.3.8), @ai4paper/dsh-ipaper (>=0.1.0, <=0.1.2) +61 more potentially affected by CVE-2026-82533 via @deepseek-ai/dsh-host-frontend-static (>=0.0.1-rc.5, <=0.1.1-rc.2)

@deepseek-ai/dsh-host-frontend-static NPM version =0.0.1-rc.5, =0.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0-rc.8.zw.4, =0.1.0, =0.0.1-rc.5, =0.0.1-rc.5, =0.0.1-rc.5, =0.1.1-rc.2 and more Source cves: CVE-2026-82533 Source advisory: MEND:CVE-2026-82533...

CVE-2026-82533

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

EUVD-2026-73161

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual...

CVE-2026-82533 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

CVE-2026-82533 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

CVE-2026-82533

DeepSeek Harness prior to 0.1.2-alpha.1 contains an authentication bypass in its local HTTP control-plane API. The root cause is that the server validates only the client-supplied Host header rather than the actual TCP connection origin, allowing a network attacker to spoof authentication. This p...

CVE-2026-82533 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a...

CVE-2026-84393

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via...

EUVD-2026-72927

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via...

CVE-2026-84393

Fortinet FortiOS 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 are affected by an improper validation of certificate with host mismatch vulnerability that may allow a remote attacker to achieve information disclosure . The attack requires high complexity and no user interaction or prior ...

CVE-2026-86600

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600

Snowflake drivers (PHP PDO, .NET, Go, Python, ODBC, libsnowflakeclient, JDBC, Node.js) are affected by a flaw in WORKLOAD_IDENTITY authentication: the driver mints a cloud workload-identity token and attaches it to the login request without verifying the configured host is a Snowflake endpoint . ...