CVE-2026-16839 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser...

CVE-2026-63641

A flaw was found in MagicMirror. The Socket.IO server in MagicMirror does not properly enforce the configured IP whitelist, allowing an unauthenticated client on an adjacent network to connect directly to module Socket.IO namespaces. This bypass enables the client to dispatch arbitrary events and...

CVE-2026-76203

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...

CVE-2026-76203 CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...

EUVD-2026-62416

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

SummaryThe default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

EUVD-2026-62366

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

CVE-2026-76164

CVE-2026-76164 is a non-blind SSRF in the AIL Framework crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling without adequate destination validation. Manual crawler tasks bypass the existing domain blacklist (assigned non-zero priority), and...

curl: Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

When curl loads a cookie file written as raw HTTP Set-Cookie: header lines and a line has no Domain attribute, the cookie is stored with co-domain == NULL, because a file import has no request-host to scope it to. On the send side, Curlcookiegetlist accepts any cookie in the bucket whose domain i...

CVE-2026-50243

A flaw in Unbound's respip module fails to verify the security status of incoming DNS answers when using response-ip rules or RPZ files. A remote attacker can exploit this by spoofing DNS answers to bypass DNSSEC protections and trigger unauthorized rewrites, redirecting clients to unintended...

Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

MAL-2026-14235 Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

CVE-2026-16839: Out-of-bounds Read

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to an integer underflow in the IPv4 IP-options parser...

PT-2026-78783

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An unauthenticated user can execute arbitrary code on the host by spoofing the source IP address in a crafted request to an Automation Broker notification endpoint. This occurs because the...

PT-2026-78648

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery...

PT-2026-95709

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 7.0.17 Suricata versions prior to 8.0.6 Description In the src/flow-hash.c file, the system may treat an IPv4 and IPv6 flow as identical if their raw address words, ports, protocol, VLAN, recursion level, live device...

CVE-2026-76203: Incorrect Behavior Order: Validate Before Canonicalize

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...

CVE-2026-76356: Authentication Bypass by Spoofing

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a...

PT-2026-78601

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description An integer underflow in the IPv4 IP-options parser allows a remote attacker to obtain sensitive information. An integer underflow occurs when an arithmetic operation results...

Malicious code in chalk-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a278b0c90f55a6a518b61ec1c964468011d1e4be184df5f36336a5f82ea58cc Package name mimics chalk but ships an empty library body; the only real behavior lives in scripts/postinstall.js. On install the script XOR-decodes...