Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF

Summary Authlib's RFC 9101 JAR extension passes the attacker-controlled requesturi authorization parameter straight to the getrequestobject fetch hook with no validation, at a pre-authentication endpoint. Authlib already defines the pre-registration allowlist for this requesturis client metadata...

Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution

Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it's observing in-the-wild exploitation of CVE-2026-6875 CVSS score: 9.5, a sandbox escape...