CVE-2026-67424 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

CVE-2026-67424

Flyto2 Core exposes a Redirect/SSRF issue in HTTP modules http.get, http.request, and http.batch (files src/core/modules/atomic/http/get.py, http/request.py, http/batch.py). Prior to version 2.26.7, these modules validate only the initial URL and then follow redirects with allow_redirects=True wi...

Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 CVSS score: 9.5, the flaw can expose the Rails process environment and secre...

Information Exposure

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache. An attacker can cause a private response to be stored in the shared...

GHSA-RWQX-FVQH-6WM4 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends...

EUVD-2026-41151

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords...

CVE-2026-12703

creationtimestamp| type| source ---|---|--- 2026-07-29 16:33:06+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrse3check23...

CVE-2026-13697

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

CVE-2026-13697

Summary of a known vulnerability in undici (CVE-2026-13697) : The cache interceptor in undici mishandles degenerate private directives in Cache-Control, enabling two issues in shared mode. First, a response with malformed qualified private directives (for example, private="" or private=",") can b...

EUVD-2026-43723

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync...

EUVD-2026-43692

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page...

EUVD-2026-43722

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network...

EUVD-2026-43726

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure...

GHSA-4VMM-5QVC-W5P7 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Summary An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Detail...

CVE-2026-54078

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

CVE-2026-66038

A flaw was found in FFmpeg, specifically within the LCL/ZLIB video decoder. A remote attacker could exploit this vulnerability by providing a specially crafted zlib stream that decompresses to a smaller size than expected. This can lead to the exposure of uninitialized heap memory, including...

CVE-2026-17550

CVE-2026-17550 describes an out-of-bounds read vulnerability in Autodesk AutoCAD when parsing malicious DWG/DXF files. The issue affects the DWG/DXF parsing component and can cause a crash or disclosure of sensitive information. According to the provided metrics, the CVSSv3.1 base score is 5.5 (M...

CVE-2026-16463

This CVE affects Autodesk AutoCAD when parsing a malicious DXF file, causing a Heap-Based Overflow in the DXF parser. The underlying flaw can crash the process, read sensitive data, or allow arbitrary code execution in the context of the current process. The CVSS metrics provided indicate a Local...

CVE-2026-54078

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...