DNS Rebinding

MCP Java SDK is vulnerable to DNS Rebinding. The vulnerability is due to lack of Origin Validation, allowing a malicious website to bypass same-origin restrictions and access a local or network-private MCP server via the victim’s browser, enabling unauthorized tool invocation...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: runc, seaweedfs, temporal, emissary, kine, trillian, helm-set-status, falco-exporter, cadvisor, prometheus-adapter, wal-g, cert-manager-csi-driver, flannel, caddy, crossplane-provider-family-azure, sriov-network-device-plugin, kubescape, terraform-provider-random,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, stakater-reloader, aws-iam-authenticator, nemo, external-secrets-operator, tailscale, temporal, nova, flux-helm-controller-fips, kubewatch, smokescreen, kyverno-policy-reporter-plugins-kyverno, victoriametrics, aws-eks-pod-identity-agent-fip...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, stakater-reloader, aws-iam-authenticator, nemo, external-secrets-operator, tailscale, temporal, nova, flux-helm-controller-fips, kubewatch, smokescreen, kyverno-policy-reporter-plugins-kyverno, victoriametrics, aws-eks-pod-identity-agent-fip...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: longhorn-cli-fips, nri-postgresql-fips, longhorn-backing-image-manager, rancher-loglevel, teleport-operator-fips, buildkite-agent, docker-credential-acr-env-fips, neuvector-scanner, plugin-barman-cloud, kiam, wave, grafana-beyla, external-secrets-operator,...

Chromium: CVE-2026-5911 Policy bypass in ServiceWorkers

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5903 Policy bypass in IFrameSandbox

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5901 Policy bypass in DevTools

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5900 Policy bypass in Downloads

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5896 Policy bypass in Audio

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5892 Insufficient policy enforcement in PWAs

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5891 Insufficient policy enforcement in browser UI

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5881 Policy bypass in LocalNetworkAccess

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-5875 Policy bypass in Blink

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-40191

Summary: CVE-2026-40191 affects ClearanceKit on macOS, where the Endpoint Security event handler prior to 5.0.4-beta-1f46165 only validated the source path of dual-path file operations against FAA rules and App Jail policies, ignoring the destination path. As a result, a local process could bypas...

CVE-2026-40191 ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization FAA rules and App Jail...

GHSA-WVHV-QCQF-F3CX goshs has a file-based ACL authorization bypass in goshs state-changing routes

Summary goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload,...

goshs has a file-based ACL authorization bypass in goshs state-changing routes

Summary goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload,...

CVE-2026-40189

CVE-2026-40189 affects goshs, a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces per-folder .goshs ACL/basic-auth for directory listings and file reads but does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can perform state-...

CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload...