CVE-2026-101057 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

xss

XSSentinel — Comprehensive XSS Detection Framework A mult...

Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

MAL-2026-17196 Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

MAL-2026-17193 Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

CVE-2026-101057: Cleartext Transmission of Sensitive Information

utcp-mcp the MCP plugin of python-utcp through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration without the ensuresecureurl validation that the HTTP-family plugins apply, so the HTTPS/WSS-or-loopback rule is not enforced. A call template...

PT-2026-99569

Name of the Vulnerable Software and Affected Versions utcp-mcp versions prior to 1.1.3 Description The MCP plugin of python-utcp fails to apply ensure secure url validation when connecting to HTTP and WebSocket MCP server URLs defined in a call template's mcpServers configuration. This omission...

RHEL 7 : unbound (RHSA-2026:72199)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72199 advisory. The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fixes: unbound: Unbound: Heap buffer overflow and...

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service MaaS platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aime...

GHSA-PG57-6JWG-Q645 vulnerabilities

Vulnerabilities for packages: cloudbeat, chaos-mesh-fips, envoy-gateway-fips, docker, helm-push, datadog-agent, trivy, harvester, k9s-fips, kubescape-operator, chartmuseum-fips, newrelic-infrastructure-agent, xeol-fips, cg, scorecard, k9s, grype-db, tigera-operator-fips, gitlab-rails-ce-fips,...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: cloudbeat, chaos-mesh-fips, envoy-gateway-fips, docker, helm-push, datadog-agent, trivy, harvester, k9s-fips, kubescape-operator, chartmuseum-fips, newrelic-infrastructure-agent, xeol-fips, cg, scorecard, k9s, grype-db, tigera-operator-fips, gitlab-rails-ce-fips,...

GHSA-PG57-6JWG-Q645 vulnerabilities

Vulnerabilities for packages: buildkitd, grype, trivy-operator, fuse-overlayfs-snapshotter, xeol, k9s, helm-set-status, steampipe, falco-no-driver, headlamp, docker, kubescape-operator, kube-arangodb, helm-mapkubeapis, kubescape, neuvector-scanner, zot, cluster-api-helm-controller, docker-compose...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: buildkitd, grype, trivy-operator, fuse-overlayfs-snapshotter, xeol, k9s, helm-set-status, steampipe, falco-no-driver, headlamp, docker, kubescape-operator, kube-arangodb, helm-mapkubeapis, kubescape, neuvector-scanner, zot, cluster-api-helm-controller, docker-compose...

Improper Neutralization of Special Elements in Data Query Logic

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via operator injection in the handleInstallation function in...

Use of Less Trusted Source

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Less Trusted Source via incomplete propagation of revision and coderevision pins across artifact boundaries in the model loader subsystem. Wh...

CVE-2026-100670

Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a security@: admin.super guard that is resolved by the field's exact path, so a submitted flat dot-notation key such as access.admin.super instead of the...

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists getcookie, which returns a...

CVE-2026-100653

vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin --revision / --code-revision is not propagated to several Hugging Face artifact loads for the FunAudioChat and Tarsier2 architectures: the...