CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

Malware in aone-cloud-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview aone-cloud-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in aone-cloud-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac6b6dc6a9ebc0c474150ee0d6545f6c3fa790ada20f247ac997ec504ce6ffc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11180 Malicious code in aone-cloud-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac6b6dc6a9ebc0c474150ee0d6545f6c3fa790ada20f247ac997ec504ce6ffc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-54735

Prebid Server (open-source in real-time advertising auctions) contains a vulnerability (CVE-2026-54735) in versions prior to 4.4.0 where certain bidder adapters interpolate user-supplied parameters into outbound request URLs without proper host/subdomain validation, enabling crafted bid requests ...

CVE-2026-40990

A flaw was found in Spring Cloud Function. A local attacker with low privileges could exploit this vulnerability by repeatedly adding functions to the Function Registry, leading to an Out Of Memory OOM error. This resource exhaustion can cause a Denial of Service DoS for the affected application...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

Google Australia Customers Now Benefit From Imperva Cloud-Native WAAP Security

Many Australian businesses have moved their applications and data to cloud-native architectures for agility, scalability, and sovereignty. However, this move extends their attack surface beyond their typical security boundaries. As evidenced by the Thales 2026 Data Threat Report, attackers...

CVE-2026-11974 Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin versions before 4.1.7 is vulnerable to Arbitrary File Disclosure and Server-Side Request Forgery (SSRF) . The root cause is the failure to validate a user-supplied parameter used in a file read operation within two AJAX actions accessible to unauthentica...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-11974 Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

cynative v1.8.0

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning through GitHub, GitLab,...

[SECURITY] Fedora 43 Update: restic-0.19.1-1.fc43

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

[SECURITY] Fedora 44 Update: restic-0.19.1-1.fc44

Fast, secure, efficient backup program. restic supports the following backends for storing backups natively: Local directory sftp server via SSH HTTP REST server protocol, rest-server Amazon S3 either from Amazon or using the Minio server OpenStack Swift BackBlaze B2 Microsoft Azure Blob Storage...

CVE-2026-54249: Server-Side Request Forgery (SSRF)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-46678: Server-Side Request Forgery (SSRF)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...

SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response

Large Language Model LLM agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces CLIs, making it critical to thoroughly assess their security capabilities. However, existing cybersecurity benchmarks focus on pre-compromise settin...