CVE-2026-63731

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

CVE-2026-63107 LimeSurvey SSRF via REST API Survey Template Host Header

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-63107

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-63107 LimeSurvey SSRF via REST API Survey Template Host Header

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

EUVD-2026-46061

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

CVE-2026-63107

LimeSurvey (versions up to 6.17.10 and 7.0.4) contains a server-side request forgery in the REST API survey template endpoint. The vulnerability arises from unsanitized use of the HTTP Host header in getTemplateData(), allowing authenticated users to cause the server to issue arbitrary HTTP reque...

CVE-2026-63107 LimeSurvey SSRF via REST API Survey Template Host Header

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

Axios: Prototype pollution auth subfields can inject Basic auth

Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...

CVE-2026-46555

WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...

CVE-2026-63807

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM x86 memory management unit MMU. A malicious guest operating system could create a hugepage mapping that extends beyond the boundaries of its allocated memory slot. This improper handling of memory boundaries by KVM can lead t...

CVE-2026-46555

WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...

CVE-2026-46555 WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration

WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...

CVE-2026-46555

The CVE applies to WhatsApp MCP Server, where the whatsapp-bridge HTTP API on 127.0.0.1:8080 is unauthenticated and lacks Host header validation. The /api/send endpoint accepts an absolute media_path, enabling a local caller (including sibling MCP servers, IDE extensions, or other processes in th...

EUVD-2026-46037

WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...

MAL-2026-10924 Malicious code in s3-lambda-dynamodb-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

USN-8570-1 linux-gcp-6.17, linux-realtime-6.17 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block...

CVE-2026-46412 Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

nodejs: Node.js: Certification validation bypass in TLS host verification

A flaw was found in Node.js. An attacker can exploit a vulnerability in the Transport Layer Security TLS host verification process to bypass certification validation. This bypass could allow an attacker to intercept or alter communications, potentially leading to information disclosure or integri...

CVE-2026-63743

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed...