PT-2026-98818

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.8 and 6.18 LTS Description An issue exists in the drm/virtio component where the virtio-gpu driver fails to correctly use the DMA API for resource backing on Xen PV domains. In these domains, page addresses do not...

web-attack-log-analyzer

Web Server Log Analyzer — Web Attack Detection A Python tool...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090675)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090675 advisory. A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from...

CVE-2026-88345

An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unterminated quotation mark, the C-string scanning logic in lex dereferences the input pointer after it has reached the end of the buffer. A specially crafted...

PT-2026-96265

Name of the Vulnerable Software and Affected Versions NocoBase version 2.1.21 Description A Server-Side Request Forgery SSRF exists in the serverRequest function. This allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF is a flaw that allows...

webanalyze v0.4.6

webanalyze This is a port of Wappalyzer in Go. This tool is designed to be performant and allows to test huge lists of hosts. !NOTE Because Wappalyzer removed the public access to their app definitions, webanalyze currently loads definitions from enthec. Installation and usage Precompiled release...

checkov v3.3.19

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

cisco-sa-sma-attack-N9bf4

Vérification d'exposition Cisco SMA Petit script Python 3 en un seul fichier pour sonder rapidement un hôte ou un domaine à la recherche de ports de gestion et de quarantaine ouverts pour Cisco Secure Email/Secure Malware Analytics indicateurs d'exposition CVE-2025-20393. Utilisation Installez...

PT-2026-94364

Name of the Vulnerable Software and Affected Versions nuxt-og-image versions 6.0.2 through 6.6.x Description An unauthenticated Server-Side Request Forgery SSRF exists when the software is used with default security settings security.strict = false and security.secret = "". The application expose...

dalfox v3.2.3

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

CVE-2026-92719

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719

Quickwit through 0.9.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its SQS file sources . The root cause is a failure to validate the host and scheme of the queue_url parameter, allowing an unauthenticated attacker to supply a malicious value via the create-source API and...

EUVD-2026-80902

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

PT-2026-93882

Name of the Vulnerable Software and Affected Versions Quickwit versions prior to 0.9.1 Description Insufficient validation of the host and scheme in the queue url parameter within SQS file sources allows an attacker to force the node to send requests to arbitrary internal addresses. By providing ...

Characterizing Network Centralization and Observability in the Remote MCP Ecosystem

The Model Context Protocol MCP has emerged as the dominant interface for connecting autonomous agents to external data sources and execution environments. The ecosystem's transition from local process execution to remote Streamable HTTP deployments introduces unmeasured architectural and security...

CVE-2026-76820

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-76820 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...