•about 1 hour ago•CVE-2026-61589
6.3CVE-2026-61589: Host Header Propagation Failure in djust WebSocket Live Path Reconstructor
CVE-2026-61589 is a security-bypass and information-disclosure vulnerability in the djust library prior to version 1.0.7. The library's WebSocket live path component fails to propagate the client HTTP Host header when dynamically reconstructing Django HttpRequest objects. Consequently, multi-tenant Django applications that rely on Host-based resolution may fail to isolate data correctly under certain configurations, leading to unauthorized cross-tenant data access.
0 views•6 min read
•about 2 hours ago•CVE-2026-61599
8.8CVE-2026-61599: Unauthenticated Arbitrary Module Import in djust Framework
A critical unauthenticated arbitrary module import vulnerability in the djust framework before version 1.0.7 allows remote attackers to execute arbitrary code by exploiting unsafe Python reflection during LiveView connection mounting.
1 views•7 min read
•about 3 hours ago•CVE-2026-59193
4.9CVE-2026-59193: Remote Denial of Service via Resource Exhaustion in Grav CMS
A denial-of-service (DoS) and resource exhaustion vulnerability exists in Grav CMS prior to version 2.0.0. The package installer decompressor fails to validate ZIP archive limits before extraction, allowing authenticated administrators to cause disk exhaustion, inode exhaustion, or process termination.
2 views•6 min read
•about 4 hours ago•CVE-2026-57173
6.5CVE-2026-57173: Unauthenticated Audio Decompression-Bomb Denial of Service in vLLM
CVE-2026-57173 (GHSA-hcwq-8wjf-3gcr) represents a critical resource allocation validation vulnerability in the vLLM inference engine. Prior to version 0.24.0, vLLM's multimodal chat completions pipeline failed to enforce maximum audio decode duration limits. Unauthenticated remote attackers can exploit this to perform an audio decompression bomb attack, causing massive memory allocations that trigger immediate system Out-Of-Memory (OOM) crashes and service termination.
6 views•6 min read
•about 5 hours ago•CVE-2026-61453
6.1CVE-2026-61453: Stored Cross-Site Scripting via Twig String Concatenation Bypass in Grav CMS
Grav CMS before v2.0.1 contains a security bypass vulnerability in its blueprint validation logic. The XSS detection routine, Security::detectXss(), was executed on raw page contents prior to Twig engine processing. When Twig processing is enabled for editor-authored page content, an attacker can dynamically reconstruct harmful HTML elements, attributes, or protocols using string concatenation (e.g. `{{ 'on' ~ 'error' }}`). When compiled, the benign source converts into active XSS payloads, which are rendered to the client browser via raw filters. This vulnerability was resolved in version 2.0.1 by adding a post-render validation backstop.
5 views•7 min read
•about 6 hours ago•CVE-2026-63127
8.2CVE-2026-63127: OAuth Resource Spoofing and Token Leakage in rmcp SDK
An OAuth resource spoofing vulnerability in the rmcp crate prior to 2.0.0 allows a malicious Model Context Protocol (MCP) server to spoof protected resource metadata. By presenting metadata pointing to a legitimate resource and authorization server, the attacker can trick the client into completing the authentication flow and subsequently sending the authorized token back to the malicious server.
5 views•7 min read
•about 7 hours ago•CVE-2026-63128
7.5CVE-2026-63128: Uncontrolled Resource Consumption in Model Context Protocol Rust SDK (rmcp)
CVE-2026-63128 is a high-severity uncontrolled resource consumption vulnerability in the Model Context Protocol (MCP) official Rust SDK (the rmcp crate) prior to version 2.0.0. An unauthenticated attacker can exploit this vulnerability by sending malformed or mismatching handshake requests to the stateful Streamable HTTP server, causing persistent memory allocation without cleanup. This results in an unbounded memory leak and lock contention that ultimately leads to complete denial of service.
6 views•6 min read
•about 8 hours ago•CVE-2026-63671
8.1CVE-2026-63671: Cross-Site Scripting (XSS) Sanitizer Bypass in @nuxtjs/mdc
A cross-site scripting (XSS) vulnerability was identified in @nuxtjs/mdc prior to version 0.22.1. Gaps in the HTML/SVG attribute verification and URL protocol parsing allow unauthenticated remote attackers to bypass the application's sanitization routines. By embedding malicious SVG links or data-encoded iframe elements within Markdown, attackers can execute arbitrary JavaScript in the victim's browser context.
4 views•6 min read
•about 9 hours ago•CVE-2026-58657
6.5CVE-2026-58657: Stored CSS Injection in Grav CMS Media Resize Parser
CVE-2026-58657 is a critical stored CSS injection vulnerability in Grav CMS's media processing pipeline. By exploiting improper sanitization of image dimensions in the resize helper, low-privileged users with page editing permissions can inject arbitrary CSS styles. This can lead to visual defacement, UI redressing, and indirect data exfiltration.
4 views•4 min read
•about 10 hours ago•CVE-2026-61709
5.3CVE-2026-61709: Improper Policy Enforcement and Exclusion Bypass in OpenFGA ListUsers API
An authorization-decision over-inclusion vulnerability exists in the OpenFGA authorization engine. The flaw manifests within the `ListUsers` API evaluation path when evaluating complex relationship intersections containing exclusions. Under certain configurations involving wildcards, the exclusion is bypassed, leading to incorrect permission lists.
8 views•7 min read
•about 11 hours ago•CVE-2026-61594
9.1CVE-2026-61594: Authorization Bypass on WebSocket and SSE Mount Paths in djust
An authorization bypass vulnerability exists in the djust framework (djust-org/djust) prior to version 1.0.7. The framework fails to enforce standard Django view-level authorization mechanisms, such as AccessMixins or dispatch decorators, when mounting reactive views over stateful transport layers (WebSockets and Server-Sent Events). Unauthenticated or low-privileged attackers can establish persistent connections to mount arbitrary protected views and execute state-changing event handlers.
8 views•7 min read
•about 12 hours ago•CVE-2026-61560
9.8CVE-2026-61560: Unauthenticated Remote Path Traversal and Access Token Exfiltration in @zereight/mcp-gitlab
CVE-2026-61560 is a critical security vulnerability in the @zereight/mcp-gitlab Server-Sent Events (SSE) server. By utilizing default, unauthenticated route setups and exposing vulnerable administrative tools, remote attackers can execute path traversal attacks to read internal process variables and hijack GitLab operations.
4 views•8 min read