CVE-2026-16084

Affected software/hardware: Sipeed PicoClaw (up to version 0.2.9). Vulnerable component: function web_fetch in pkg/tools/integration/web.go. Root cause: manipulation enabling server-side request forgery (SSRF). Impact: remote exploitation possible with low attack complexity and network access; ab...

PT-2026-60971

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web shared.go of the component web fetch. Such manipulation leads to server-side request forgery. The attack can be launched...

GO-2026-6006 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit in github.com/envoyproxy/gateway...

Metasploit Wrap Up: An HTTP to SMB relay plus Payload Improvements

Metasploit Wrap Up Housekeeping While the Metasploit Framework will be continuing its weekly release cadence, bringing you dear reader our latest content, the Weekly Wrap Up is being shifted to a bi-weekly cadence. The team is planning to use the additional time between posts to record demos of...

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch Summary The uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or...

GHSA-45GF-FJXP-CJPQ meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch Summary The uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or...

CVE-2026-49215 Symfony UX: CSRF Protection Bypass in symfony/ux-live-component — Accept Header is CORS-Safelisted

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest gates LiveAction invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and...

CVE-2026-13410

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSLverifymode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept the...

EUVD-2026-45168

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSLverifymode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept the...

CVE-2026-62212 OpenClaw < 2026.5.28 Authentication Bypass via safeFetch

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should hav...

PT-2026-60745

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL verify mode explicitly disabled. An attacker with network man-in-the-middle MITM capability between the Dancer application and googleapis.com can intercept th...

PT-2026-60897

Name of the Vulnerable Software and Affected Versions meta-ads-mcp version 1.0.113 Description An unauthenticated remote attacker can perform a Server-Side Request Forgery SSRF when the server is deployed using the streamable-http transport. The upload ad image tool accepts an image url parameter...

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

GHSA-22XC-XG2R-9J7V Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

GHSA-CXPQ-8V7Q-CG56 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset optional field; check is post-decompression anyway - No operator...

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant can create EnvoyExtensionPolicy baseline - Attacker hosts a gzip-bomb at a reachable URL - sha256 unset optional field; check is post-decompression anyway - No operator...

MAL-2026-10728 Malicious code in bvm-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca dist/index.js in [email protected] imports childprocess and issues fetch calls to the hardcoded host https://bvm-core.nexsail.top at the top of the...

Malicious code in patchwork-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...

Malicious code in telemetry-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca5a92b8a793861df4d3480ffa064564909421659b72e6a9bb1f6af72847f55 The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all reference the legitimate...

MAL-2026-10750 Malicious code in telemetry-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca5a92b8a793861df4d3480ffa064564909421659b72e6a9bb1f6af72847f55 The package publishes as unscoped 'telemetry-metrics' while its README, repository, homepage, and bugs metadata all reference the legitimate...