CVE-2026-48508

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...

CVE-2026-48508 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...

EUVD-2026-61100

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...

CVE-2026-48508 Lemur: Authorization bypass in StrictRolePermission / AuthorityCreatorPermission

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flaskprincipal.Permission.init with zero Need objects when ADMINONLYAUTHORITYCREATION and LEMURSTRICTROLEENFORCEMENT are unset because both flags default t...

GHSA-95PX-34X5-P37H MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

MobSF has SSRF port restriction bypass in assetlinks_check

Summary MobSF's Android App Link assetlinks checker validates only the manifest android:host value with validhost, but then appends the separate android:port value into the URL used for the server-side request. This bypasses the current port restriction in validhost and lets a crafted APK cause...

CVE-2026-49452 WeasyPrint: CSS Injection via Presentational Hints

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/init.py when presentationalhints=True. The background attribute is inserted into a background-image:url declaration and parsed b...

CVE-2026-49452

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/init.py when presentationalhints=True. The background attribute is inserted into a background-image:url declaration and parsed b...

CVE-2026-49452

In weasyprint/css/__init__.py, the background HTML attribute is interpolated unescaped into background-image:url({element.get("background")}) and parsed by tinycss2.parse_blocks_contents(). A PoC () demonstrates CSS injection and SSRF against cloud metadata endpoints. Affected only when presentat...

EUVD-2026-61133

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

CVE-2026-68927

MobSF (Mobile Security Framework) prior to 4.5.1 contains an SSRF port restriction bypass in the Android App Link assetlinks checker. The function get_browsable_activities in manifest_analysis.py validates only the android:host value via valid_host(), but appends a separately supplied android:por...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

CVE-2026-68927 MobSF: SSRF port restriction bypass in assetlinks_check

MobSF is a mobile application security testing tool used. Prior to 4.5.1, getbrowsableactivities in mobsf/StaticAnalyzer/views/android/manifestanalysis.py validates only an Android manifest android:host value with validhost before appending a separately supplied android:port to the URL fetched by...

Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets

Two critical vulnerabilities impacting MLflow, an open-source artificial intelligence AI platform, and FUXA, an open-source, web-based SCADA / HMI software built for operational technology OT and industrial automation, are witnessing malicious scanning and exploitation efforts. According to...

NPM: MagicMirror: ssrf calendar .js

NPM: MagicMirror: ssrf calendar .js vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

MagicMirror: ssrf calendar .js

Vulnerability — SSRF via ADDCALENDAR MagicMirror² calendar Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint |...

MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

Vulnerability — Blind SSRF via CHECKARTICLEURL MagicMirror² newsfeed Analysis of the PoC exploit-ssrf-newsfeed.js. Target: newsfeed/nodehelper.js of MagicMirror², socket.io namespace /newsfeed. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-newsfeed.js | | Endpoi...

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

EUVD-2026-61072

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...