CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

PT-2026-58097

Письмо, которое ходит за вас: разбираю свежий SSRF в Roundcube на живом стенде habr https://habr.com/ru/articles/1061638/ Tags: Roundcube, SSRF, CVE-2026-62643, вебмейл, sslip.io, XSS, почтовый сервер Author: CynepMyx...

PT-2026-59539

Summary PraisonAI's spider tools URL validation can be bypassed using alternate loopback host encodings. The affected component is: text praisonaiagents/tools/spider tools.py The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled...

EUVD-2026-42980

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...