CVE-2026-29971

CVE-2026-29971 Um atacante pode executar JavaScript arbitrário no navegador da vítima, potencialmente levando ao sequestro de sessão ou escalação de privilégios. CVE-2026-29971 Vulnerabilidade Cross-Site Scripting Refletido XSS Produto Afetado WebFileSys Versão Afetada 2.31.1 Descrição Existe uma...

PoC-CVE-2020-9715

CVE-2020-9715 EDR सत्यापन PoC Adobe Acrobat Reader DC के EScript.api ESObject कैश में Use-after-free भेद्यता। केवल अधिकृत रेड टीम EDR परीक्षण के लिए। भेद्यता Adobe Acrobat Reader DC = 2020.009.20063। EScript इंजन डेटा ESObjects को उन कुंजियों के साथ कैश करता है जो मूल एन्कोडिंग ANSI या Unicode को...

GO-2026-6271 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) in github.com/axllent/mailpit

Mailpit: WebSocket origin check bypass via percent-encoded path regression of CVE-2026-22689 in github.com/axllent/mailpit...

Important: Red Hat Security Advisory: Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4

Kiali 2.27.3 for Red Hat OpenShift Service Mesh 3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

google-chrome-emergency-update

Aggiornamento di Sicurezza Urgente di Chrome Questo repository contiene informazioni e strumenti relativi all'aggiornamento urgente di Chrome di Google per correggere vulnerabilità di sicurezza critiche. 🚨 Avviso di Aggiornamento Urgente Google ha rilasciato un aggiornamento urgente di Chrome per...

EUVD-2026-65739

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...

CVE-2026-43670

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...

CVE-2026-43670

A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy...

CVE-2026-43670

CVE-2026-43670 is a Content Security Policy (CSP) bypass in WebKit's AudioWorklet context , fixed in Safari 26.5 , iOS 18.7.9 / iPadOS 18.7.9 , iOS 26.5 / iPadOS 26.5 , and macOS Tahoe 26.5 . Processing maliciously crafted web content may allow an attacker to circumvent CSP, potentially enabling ...

Important: Red Hat Security Advisory: Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3

Kiali 2.22.9 for Red Hat OpenShift Service Mesh 3.3 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

GHSA-HVFH-5MJ3-5F3J Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access

Am I affected? Only if your deployment sets features.mcp.enabled = true in .chainlit/config.toml. MCP has been disabled by default since v2.7.0, so most Chainlit deployments are not affected. No authentication is required: /mcp is reachable by any client that can open a session. Summary When MCP ...

CVE-2026-80049

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

CVE-2026-79787

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

CVE-2026-55618

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...

CVE-2026-32722

CVE-2026-32722 XSS persistente di Bloomberg Memray tramite metadati della riga di comando non escapati Introduzione Ho trovato questo problema mentre analizzavo Memray , il profiler di memoria Python di Bloomberg, con una semplice domanda in mente: I metadati di runtime controllati da un attaccan...

vuln-chain-lab

File Upload Bypass + Stored XSS PoC Labor Eine bewusst verwundbare Webanwendung, die zeigt, wie ein File-Upload-Bypass mit Stored-XSS verkettet wird, um Backdoor-Admin-Konten zu erstellen, selbst wenn CSP-, CORS- und CSRF-Schutzmaßnahmen vorhanden sind. Ausführlicher Blogbeitrag: KurtiseBear Blog...

CVE-2026-78379 Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

CVE-2026-78379 Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

Important: Red Hat Security Advisory: Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1

Kiali 2.11.16 for Red Hat OpenShift Service Mesh 3.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...