PT-2026-84918

A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine...

MAL-2026-16010 Malicious code in AzureCdnInfo.edrtester (VSCode)

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester version 1.0.4 presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and...

PT-2026-95385

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.1 Description A sandbox escape exists in VM and NodeVM when an embedder exposes a host API that returns a host-realm Promise. The bridge's rejection sanitizer, specifically the functions hostPromiseSanitizeReject,...

CVE-2026-84394: Interpretation Conflict

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

Malicious code in AzureCdnInfo.edrtester (VSCode)

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester version 1.0.4 presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and...

VMSA-2026-0007: VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities (CVE-2026-59346, CVE-2026-59347)

Advisory ID: | VMSA-2026-0007 ---|--- Advisory Severity: | Critical CVSSv3 Range: | 8.1-9.3 Synopsis: | VMware Workstation and Fusion updates address integer-overflow and buffer overflow vulnerabilities CVE-2026-59346, CVE-2026-59347 Issue date: | 2026-09-03 Updated on: | 2026-09-03 Initial...

CVE-2026-9744: Improper Validation of Certificate with Host Mismatch

IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

Linux Distros Unpatched Vulnerability : CVE-2026-84292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port...

Linux Distros Unpatched Vulnerability : CVE-2026-84394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but do...

EUVD-2026-63465

Hurl: Cookies in Cookies section leak when redirecting to a different host...

Hurl: Cookies in Cookies section leak when redirecting to a different host

The Bug Hurl = 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the Header/headers area 2. In a dedicated Cookies section parsed into RequestSpec.cookies When following a redirect to a different host, Hurl correctly strips security-sensitive data Authorization...

GHSA-7W2G-9MF9-324M Hurl: Cookies in Cookies section leak when redirecting to a different host

The Bug Hurl = 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the Header/headers area 2. In a dedicated Cookies section parsed into RequestSpec.cookies When following a redirect to a different host, Hurl correctly strips security-sensitive data Authorization...

GHSA-P8RW-8QJ3-HF33 Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE

Summary An authenticated, non-admin user can obtain arbitrary host-filesystem read/write and host environment-secret disclosure on an Omnigent runner by uploading an agent bundle whose osenv.cwd points outside any intended workspace e.g. / or /home/. The cwd field is taken verbatim from the bundl...

Host Confusion

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Host Confusion in the parse function, which returns a host that begins with but has no closing , such as @127.0.0.1, without validating it as an IPv6 literal or canonicalizing it as a...

CVE-2026-84394

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394

fast-uri (a URI parsing library used by the Fastify ecosystem) contains a host confusion vulnerability: when a URI's authority contains an opening bracket [ without a matching closing bracket ], parse() returns the string as the host without error. Neither an IP literal nor a valid domain name is...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

CVE-2026-84394 fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...