CVE-2026-72924 GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-72924 GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

EUVD-2026-66116

GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...

CVE-2026-65088

NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-65087

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-79220

CVE-2026-79220 is an information leak in the Network component of Google Chrome prior to version 152.0.7977.65 . A remote attacker who has already compromised the renderer process can exploit this flaw via a crafted HTML page to obtain sensitive information. The vulnerability carries a CVSS 3.1 s...

CVE-2026-79068

CVE-2026-79068 is an improper resource exposure flaw in the StreamsAPI component of Google Chrome prior to 152.0.7977.65 . A remote attacker can craft a malicious HTML page to bypass the web origin policy , potentially gaining access to a privileged page . The CVSS 3.1 score is 4.3 (Medium) with ...

CVE-2026-79068

Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79068

Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79031

Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79031

Improper resource exposure in the Preload component of Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. Site isolation is a security feature designed to protect against data theft and malicious code execution between websites. The vu...

CVE-2026-79031

Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

ROOT-OS-DEBIAN-12-CVE-2023-29934 CVE-2023-29934 in llvm-toolchain-14 - Patched by Root

Root has patched CVE-2023-29934 in the llvm-toolchain-14 package for Root:Debian:12. Multiple fixed versions available...

GHSA-72F3-6W86-7RV3 @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint

Summary The self-hosted HTTP transport of @arikusi/deepseek-mcp-server exposes POST /mcp without any authentication: createMcpExpressApp is called without an authProvider and no middleware guards the route, so any network-reachable client can issue an unauthenticated initialize request and obtain...

GHSA-FH3R-G96V-F578 @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

Cross-Session Data Exposure via Caller-Controlled sessionid Project / Repository: arikusi/deepseek-mcp-server Affected version / commit tested: 1.6.0 / 04f28be2c6e99d3d4e443a6ae37cc35f0a71554a Vulnerability type: Authorization bypass / cross-session data exposure Authentication required: No Summa...

CVE-2026-55637

genieacs-mcp is an MCP server for GenieACS written in Go. Prior to 0.3.2, the Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp listener on the default MCPLISTENADDR value 127.0.0.1:8080 when MCPAUTHTOKEN is unset and the httpSrv.Startaddr branch does not validate th...

Malicious code in hexdrift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f6b00b26052d34947326afc5e17df34500b077e8ed58daa9e9f67c3a93737e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

USN-8676-1 openjdk-17 vulnerabilities

It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. CVE-2026-46968 It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attack...

Malicious code in r4wk-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5cbca68751eb879140f7c896a0dc3c324e9f4dbc8a1651b38b246b299ba4eb On npm install, the package's postinstall hook runs node.worker.js, which detaches a background child, waits a jittered delay, and opens a TCP socket...

CVE-2026-55553

urllib is an HTTP client for Node.js. Prior to versions 2.44.1 and 4.9.1 , its redirect-following logic in src/HttpClient.ts reuses caller-supplied options across origin boundaries. When #requestInternal recursively processes a redirect to a different scheme, host, or port, headers such as Author...