CVE-2026-22812

🔐 CVE-2026-22812 — Неаутентифицированный HTTP-сервер OpenCode → удалённое выполнение кода RCE Уведомление безопасности, технический анализ, рекомендации по обнаружению и меры по смягчению последствий для CVE-2026-22812 📌 Обзор CVE-2026-22812 — это уязвимость высокой степени серьёзности, приводяща...

DNSnitch

DNSnitch Disclaimer I use that for myself, it's here if someone needs it though. Feel free to open an issue if you find bugs! The Interactive Terminal DNS Firewall DNSnitch is a local, privacy-first DNS server that puts you in complete control of your network traffic. Unlike passive blocklists,...

log4j2_CVE-2021-44228

Тестирование среды log4j2, использование на свой страх и риск Моя тестовая среда — Java 17. При необходимости измените и повторно импортируйте проект. После запуска среды адрес: http://127.0.0.1:8006/test...

CVE-2023-45184

CVE-2023-45184 IBM i Access Client Solutions 1.1.9.4 - Contrôle d'accès cassé sur le serveur local. Chronologie Vulnérabilité signalée au fournisseur : 22.09.2023 Nouvelle version corrigée 1.1.9.4 publiée : 08.12.2023 Divulgation publique : 15.12.2023 Description IBM i Access Client Solutions, po...

hacker-profile

Install dependencies: root@kitploit: bundle install npm i Test with local web server: root@kitploit: $ bundle exec middleman server Build: root@kitploit: $ gulp build $ bundle exec middleman build...

binaryninja-ollama

Binary Ninja Ollama v1.0.9 Autor: Austin Haggard O Binary Ninja Ollama se integra ao seu próprio servidor ollama hospedado localmente para renomear funções e variáveis com IA Descrição: Ollama é uma ferramenta que permite baixar modelos de IA de código aberto e executá-los localmente. Alguns...

CVE-2026-81095

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

GraphSpy

GraphSpy root@kitploit: / / by RedByte1337 / / / / | | / / / \ \ \ \ \ | | \ \ \ \ | | \ \ \ | / | | | \ / \ | \ | \ /| | | /|| / / / | / /|| / /|| / Índice GraphSpy Índice Início Rápido Instalação Execução Uso Recursos Notas de Versão Recursos Futuros Patrocinadores Créditos Início...

CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

DEBIAN-CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

UBUNTU-CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-63118

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

CVE-2026-63118 MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

PYSEC-2026-3459 Anki's local HTTP server does not sufficiently validate requests

Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. While the server has a CORS setup, requests from other origins were not blocked, allowing malicious websites to potentially trigger side-effecting requests. Browser impact The severity varies ...

CVE-2026-46701 Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret process.env'NETWORKAIMCPSECRET' ?? '' at bin/mcp-server.ts:89, which causes isAuthorized lib/mcp-transport-sse.ts:254 to return true unconditionally for every reques...

GHSA-Q78P-HJ9H-5466 FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

Impact The FiftyOne App/API server fiftyone/server/app.py and the /media route fiftyone/server/routes/media.py unconditionally set a permissive CORS header Access-Control-Allow-Origin: on their responses. Because the embedded App server runs locally and is unauthenticated, this allows any website...

Linux Distros Unpatched Vulnerability : CVE-2026-59153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its...

CVE-2026-59153

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, Anki launches a local HTTP server to serve media files and web pages for parts of its interface, but requests from other origins were not sufficiently blocked. A malicious website could potentially trigger side-effecting...