•about 1 hour ago•CVE-2026-69201
5.9CVE-2026-69201: Path Traversal and Directory Escape in http4s Static Content Services
CVE-2026-69201 is a critical directory traversal vulnerability in the http4s Scala library. Affected versions of ResourceService and WebjarService allow attackers to escape the configured resource directory and access arbitrary files on the classpath or filesystem by using percent-encoded path separators. The flaw arises from decoding URL segments prior to validating them against directory escape patterns.
2 views•8 min read
•about 2 hours ago•CVE-2026-61544
8.2CVE-2026-61544: Remote Panic in libp2p-quic via Certificate Expiry Race
CVE-2026-61544 is a high-severity remote Denial of Service (DoS) vulnerability in libp2p-quic, the QUIC transport implementation of the official Rust networking stack for libp2p. It allows unauthenticated remote attackers to trigger an uncaught panic and crash listener applications.
3 views•7 min read
•about 3 hours ago•CVE-2026-88975
7.5CVE-2026-88975: Heap Memory Exhaustion via Malicious HTTP/2 Frame Size in http4s Ember
An uncontrolled resource consumption vulnerability in the http4s Ember HTTP/2 server and client implementation leads to unauthenticated heap memory exhaustion and denial of service. The vulnerability stems from deferring frame size validation until the entire declared payload size is buffered.
2 views•6 min read
•about 4 hours ago•CVE-2026-61554
7.5CVE-2026-61554: Uncontrolled Resource Consumption in emp3r0r C2 http_poll Transport
CVE-2026-61554 is a high-severity uncontrolled resource consumption vulnerability in the http_poll transport component of the emp3r0r Command and Control (C2) framework. In affected versions prior to 4.2.5, the C2 server allocates session tracking resources, spawns execution routines, and routes incoming unauthenticated request bodies into the core dispatch engine before verifying the client's cryptographic authentication token. This logical ordering flaw allows unauthenticated remote attackers to exhaust critical host system resources and trigger a sustained denial of service.
6 views•6 min read
•about 10 hours ago•GHSA-5648-RGJ9-V224
8.1GHSA-5648-RGJ9-V224: Multiple Security Control Bypasses in @zereight/mcp-gitlab
A constellation of five distinct security flaws (F1 through F5) in `@zereight/mcp-gitlab` prior to version 2.1.30 allows unauthenticated remote access, read-only policy bypasses, DNS rebinding, and denial-of-service via session exhaustion.
4 views•6 min read
•about 11 hours ago•CVE-2026-61568
9.6CVE-2026-61568: DNS Rebinding Vulnerability in @zereight/mcp-gitlab Streamable HTTP Transport
A critical security vulnerability has been identified in the @zereight/mcp-gitlab implementation of the Model Context Protocol (MCP) server. Prior to version 2.1.30, the server lacks HTTP Host and Origin header validation on its Streamable HTTP transport interface (/mcp). This security omission permits remote attackers to bypass the Same-Origin Policy (SOP) via a DNS Rebinding attack. Under this vector, an attacker can route malicious API requests to the victim's local or internal MCP server, thereby gaining unauthorized control over the victim's GitLab account and resources.
9 views•9 min read
•about 12 hours ago•CVE-2026-61559
9.6CVE-2026-61559: Critical Server-Side Request Forgery and Token Leakage in @zereight/mcp-gitlab
A critical Server-Side Request Forgery (SSRF) vulnerability in @zereight/mcp-gitlab allows attackers to leak sensitive GitLab Private-Tokens by supplying an arbitrary external hostname via the X-GitLab-API-URL header when dynamic routing is enabled.
6 views•7 min read
•about 13 hours ago•CVE-2026-69208
7.5CVE-2026-69208: Memory Leak and Denial of Service in http4s DigestAuth Middleware
A critical memory leak vulnerability exists in the server-side DigestAuth middleware of the http4s library. Due to a logical inversion in the stale-nonce clean-up routine, the internal cache fails to evict stale nonces while prematurely purging fresh ones. Unauthenticated remote attackers can exploit this behavior by repeatedly prompting the server for authentication challenges, leading to unbounded memory consumption and application crashes via a java.lang.OutOfMemoryError.
6 views•6 min read
•about 14 hours ago•CVE-2026-56830
6.5CVE-2026-56830: Broken Function Level Authorization in Shopper Media Component
An incomplete security fix in Shopper prior to version 2.9.2 exposes a Broken Function Level Authorization (BFLA) vulnerability in the Media component. Low-privileged administrative users with 'browse_products' permissions can bypass role-based access control policies to execute the 'store' action and modify product media.
4 views•6 min read
•about 15 hours ago•CVE-2026-56825
8.1CVE-2026-56825: Missing Authorization and State Tampering in Shopper e-commerce Admin Panel
A critical authorization bypass and insecure direct object reference (IDOR) vulnerability was discovered in Shopper, a Headless e-commerce Admin Panel. Due to missing authorization chains on table actions and the lack of a locked property on the collection state model, authenticated low-privilege staff can detach products from arbitrary collections.
5 views•9 min read
•about 17 hours ago•CVE-2026-59973
8.5CVE-2026-59973: High-Severity Server-Side Request Forgery in FrontMCP and mcp-from-openapi
CVE-2026-59973 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in FrontMCP and its underlying OpenAPI parsing library, mcp-from-openapi. The flaw allows authenticated attackers capable of importing or configuring OpenAPI specifications to bypass string-based hostname filtering mechanisms. By employing DNS wildcard loopbacks, HTTP redirects, or IPv4-mapped IPv6 address formatting, attackers can coerce the application into sending HTTP requests to internal networks, loopback adapters, and cloud metadata environments.
8 views•7 min read
•about 23 hours ago•CVE-2026-3888
7.8CVE-2026-3888: Local Privilege Escalation in snapd via systemd-tmpfiles
CVE-2026-3888 is a critical local privilege escalation vulnerability arising from the insecure interaction between Canonical's snap-confine helper binary and systemd-tmpfiles within the world-writable /tmp directory.
11 views•6 min read