EUVD-2026-94645

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel...

GHSA-3WP9-XFWM-RJJF AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://. Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to th...

CVE-2021-46702

CVE-2021-46702 Description: Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by...

EUVD-2026-94642

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host...

CVE-2025-55183

CVE-2025-55183 Escáner para la vulnerabilidad de exposición del código fuente de React Server Functions. ¿Qué es esto? CVE-2025-55183: Las Server Actions de React 19.0.0-19.2.1 pueden ser explotadas para exponer su código fuente completo, incluyendo secretos hardcodeados, claves API y credenciale...

CVE-2026-64849.yaml

id: CVE-2026-64849 info: name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass author: DhiyaneshDk severity: critical description: | MLflow 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach interna...

CVE-2026-53959

CVE-2026-53959 - 4gaBoards 3.3.9 - User Information Disclosure This repo contains a Proof of ConceptPoC exploit for CVE-2026-53959 Disclaimer This project is provided for educational purposes and authorized security testing only. Do not use it against systems that you do not own or have permissio...

EUVD-2026-94636

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext...

CVE-2026-107291 Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can still export sensitive agent content through exception.message and...

CVE-2026-107291 Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can still export sensitive agent content through exception.message and...

EUVD-2026-95095

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can still export sensitive agent content through exception.message and...

CVE-2026-107291

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can still export sensitive agent content through exception.message and...

CVE-2026-107291 Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettingsincludecontent=False can still export sensitive agent content through exception.message and...

CVE-2026-107291

The Pydantic AI Python agent framework is vulnerable to sensitive information disclosure in versions 0.3.4 through 1.107.6 and 2.44.0 . When OpenTelemetry instrumentation is configured with include_content=False, the system fails to redact sensitive agent content from exception.message and except...

CVE-2026-2828-WebGPU-Cross-Origin-Pixel-Stealing-via-Timing

4. CVE-2026-2828 – WebGPU Cross‑Origin Pixel Stealing via Timing Overview A malicious website uses WebGPU compute shader timing to measure rendering time of a cross‑origin iframe, recovering pixel values of sensitive content e.g., banking details. Severity: High Information Disclosure...

EQGRP_Lost_in_Translation

EQGRP Lost in Translation Decrypted content of odd.tar.xz.gpg, swift.tar.xz.gpg and windows.tar.xz.gpg Downloaded from https://yadi.sk/d/NJqzpqo3GxZA4 Original post from the ShadowBrokers https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation windows : contains Windows exploits,...

CVE-2026-107289

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...

CVE-2026-107288

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback compare blockeddomains entries with a URL hostname before both values are normalized to the form used by...

ios-nehelper-enum-apps-0day

nehelper enumerate installed apps 0-day iOS 15.0 I've updated this code to avoid using Private API directly. Read more in my blog post. However, that means that now this code is iOS version-specific and possibly device model-specific. So if it doesn't work on your device, recalculate and update t...