CVE-2026-49452 WeasyPrint: CSS Injection via Presentational Hints

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/init.py when presentationalhints=True. The background attribute is inserted into a background-image:url declaration and parsed b...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps

Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that it said could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session. The flaws, which the researchers collectively...

MagicMirror: ssrf calendar .js

Vulnerability — SSRF via ADDCALENDAR MagicMirror² calendar Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint |...

MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

Vulnerability — Blind SSRF via CHECKARTICLEURL MagicMirror² newsfeed Analysis of the PoC exploit-ssrf-newsfeed.js. Target: newsfeed/nodehelper.js of MagicMirror², socket.io namespace /newsfeed. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-newsfeed.js | | Endpoi...

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

CVE-2026-63643 MagicMirror: ssrf calendar .js

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADDCALENDAR handler in defaultmodules/calendar/nodehelper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handle...

CVE-2026-63643 MagicMirror: ssrf calendar .js

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADDCALENDAR handler in defaultmodules/calendar/nodehelper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handle...

Hunting MacSync Stealer infrastructure through behavioral pivots

In this article 1. Activity overview 2. Discovery of additional rotating infrastructure 3. Attack chain overview 4. Mitigation and protection guidance 5. References 6. Learn more MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads,...

WordPress StoreEngine plugin <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability

Authenticated Vendor+ Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability discovered by zickzick2 - Sejong University of cyber security student in WordPress Plugin StoreEngine versions = 2.1.1...

WordPress ProSolution WP Client plugin < 2.0.9 - Subscriber+ SSRF via proSol_url_validate vulnerability

Subscriber+ SSRF via proSolurlvalidate vulnerability discovered by Nir Yehoshua in WordPress Plugin ProSolution WP Client versions 2.0.9...

CVE-2026-75858

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlmeval tool. The tool's approvalrequirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to...

CVE-2026-71365

A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...

CVE-2026-45129

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45128

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...