PT-2026-110767

Name of the Vulnerable Software and Affected Versions Gitoxide gix-pack versions prior to 0.75.0 Description A denial of service issue exists where malicious remotes can crash fetch operations by sending crafted thin-pack OFS DELTA entries. An attacker can provide a thin pack containing a REF DEL...

CVE-2026-96618: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. Hex treats a mirror configured with...

PT-2026-110632

Name of the Vulnerable Software and Affected Versions hexpm hex versions 0.20.2 through 2.5.1 Description Improper validation of integrity check values allows a package mirror to substitute a tarball when using the mix hex.package fetch PACKAGE VERSION --output - command. Hex typically compares a...

AlmaLinux 10 : kernel (ALSA-2026:75576)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:75576 advisory. kernel: net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer CVE-2026-64034 kernel: dm-integrity: don't increment hashoffset twice...

PT-2026-110768

Name of the Vulnerable Software and Affected Versions Gitoxide gix-pack versions prior to 0.75.0 Description An uncontrolled memory allocation issue exists where remote attackers can cause a process to abort. By providing a 12-byte pack header that claims 0xFFFFFFFF objects, a malicious remote ca...

CVE-2026-109351: Allocation of Resources Without Limits or Throttling

Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header claiming 0xFFFFFFFF objects, forcing Tree::withcapacity to...

CVE-2026-108594

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

CVE-2026-108594

Mealie versions 3.26.0 through 3.28.0 are vulnerable to a server-side request forgery (SSRF) vulnerability in the OpenID Connect (OIDC) avatar fetch mechanism. The root cause is that the system ignores ports when allowlisting the identity provider hostname. Consequently, authenticated OIDC users ...

CVE-2026-108594 Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

CVE-2026-108594 Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

EUVD-2026-96400

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws

Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence AI models exhibited misaligned behavior and targeted real websites. The AI company said it identified...

PT-2026-109674

Name of the Vulnerable Software and Affected Versions zotero-mcp versions 0.10.0 through 0.14.1 Description A server-side request forgery SSRF issue exists where the fetch embedded metadata function fetches URLs without validating the destination. Attackers can use prompt injection to force the...

PT-2026-109734

Name of the Vulnerable Software and Affected Versions Mealie versions 3.26.0 through 3.28.0 Description An issue exists in the OpenID Connect OIDC avatar fetch process where the system ignores ports when allowlisting the identity provider hostname. This allows authenticated OIDC users who can...

CVE-2026-108594: Server-Side Request Forgery (SSRF)

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

CVE-2026-108110

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

CVE-2026-108110 MOVO through 0.2.3 Authorization Bypass via Document Endpoints

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or...

MAL-2026-17711 Malicious code in wix-reg-poc-bypass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships ...

Malicious code in wix-reg-poc-bypass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships ...