CVE-2026-107292 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...

DEBIAN-CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

Versions of FFmpeg through 9.0.2 are vulnerable to a missing SSH host key verification issue within the libssh-based sftp protocol handler . This flaw allows network attackers to perform man-in-the-middle , DNS, or ARP spoofing to impersonate SFTP servers. Consequences include the ability to capt...

CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675 FFmpeg through 9.0.2 Missing SSH Host Key Verification in sftp Protocol

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

CVE-2026-107675

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

MAL-2026-17691 Malicious code in @galicia-toolkit/tag-manager (npm)

@galicia-toolkit/tag-manager claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs node postinstall.js || true on npm install; the script collects host, platform, runtime, network, and environment data, then sends it over HTTP to...

MAL-2026-17690 Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

SUSE-SU-2026:4589-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive token...

CVE-2026-104659

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a remote brute-force attack on the administrator password due to missing Host header validation and a lack of throttling on failed sign-ins within the REST API listener. While the listener is off by default and bound to ...

CVE-2026-87428

In Brocade ASCG versions prior to 3.5.0 , a local unauthorized user on the ASCG VM can exploit a vulnerability to extract stored management credentials for onboarded SANnav instances. By issuing a request to the SANnav host network namespace , an attacker can obtain these credentials to compromis...

CVE-2026-106510

A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers...

CVE-2026-94581

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

CVE-2026-94581

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...

CVE-2026-94581

Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 are vulnerable to an OS command injection vulnerability in the REST API management interface. An authenticated, high-privileged remote attacker who possesses administrative privileges to configure SSH known host settings can sup...

EUVD-2026-94741

An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with...