Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Summary When oauth2client UPDATEAVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim. The affected code path calls http.Geturl without...

EUVD-2026-42325

Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication...

CVE-2026-56580

HCL MyCloud was affected by Using Components with Known Vulnerability IIS Server . It may allow attackers to exploit publicly disclosed weaknesses and compromise the system...

CVE-2026-56580 HCL MyCloud was affected by Using Components with Known Vulnerability

HCL MyCloud was affected by Using Components with Known Vulnerability IIS Server . It may allow attackers to exploit publicly disclosed weaknesses and compromise the system...

CVE-2026-56580

HCL MyCloud was affected by Using Components with Known Vulnerability IIS Server . It may allow attackers to exploit publicly disclosed weaknesses and compromise the system...

EUVD-2026-46343

HCL MyCloud was affected by Using Components with Known Vulnerability IIS Server . It may allow attackers to exploit publicly disclosed weaknesses and compromise the system...

AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

Hidden text on a web page was enough to make Kiro, AWS's agentic coding IDE, rewrite its own configuration file and run an attacker's code on a developer's machine, with no approval step able to stop it. Intezer, in research with Kodem Security, found that a request as ordinary as asking Kiro to...

EUVD-2026-46278

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...

CVE-2026-59851

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

EUVD-2026-46268

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

CVE-2026-16389 Incorrect boundary conditions, integer overflow in the Libraries component in NSS

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16389 Incorrect boundary conditions, integer overflow in the Libraries component in NSS

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16389

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16389

Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

Information Exposure

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure through the OIDCClientSecretConfigWrapper in...

CLEANSTART-2026-MM40347 Security fixes for CVE-2026-41080, CVE-2026-45186 applied in versions: 2.35.9-r1, 2.35.9-r2

Multiple security vulnerabilities affect the aws-cli package. These issues are resolved in later releases. See references for individual vulnerability details...

MAL-2026-10978 Malicious code in reimagined-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70b417d0787324aa952fe69c59b47f6bea108ab02fd20241a6597c2ee0e6f3d8 The package reimagined-broccoli ships a benign-looking stub at reimaginedbroccoli/main.py that only prints a success message. The tarball also ships...

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary spring-web-7.0.7.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Vulnerability Details CVEID:CVE-2026-41839 DESCRIPTION: A WebFlux application with a compromised subdomain for example, compromised via...

MAL-2026-10973 Malicious code in fluffy-octo-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that...