•about 1 hour ago•CVE-2026-91130
9.3CVE-2026-91130: DOM-Based Cross-Site Scripting in Home Assistant Statistics Graph Card
CVE-2026-91130 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Home Assistant open-source home automation platform. Prior to version 2026.7.0, the Statistics Graph card rendered series tooltips using raw HTML string interpolation without escaping user-controlled entity friendly names. By abusing this vulnerability, an authenticated user with low-privilege access can inject arbitrary HTML and JavaScript into entity name fields, which executes in the context of an administrative user's browser session upon hovering over a data point on an affected chart.
2 views•5 min read
•about 2 hours ago•CVE-2026-58268
7.5CVE-2026-58268: Denial of Service via Uncontrolled Memory Allocation in emiago/sipgo Stream Parser
A high-severity denial of service vulnerability exists in the emiago/sipgo Go library when parsing stream-based SIP messages. The stream parser fails to validate declared Content-Length header sizes before initiating memory allocations, allowing remote, unauthenticated attackers to trigger process memory exhaustion and application crashes.
5 views•6 min read
•about 3 hours ago•CVE-2026-58270
6.5CVE-2026-58270: Regular Expression Denial of Service (ReDoS) in Sync-in Server
CVE-2026-58270 identifies a Regular Expression Denial of Service (ReDoS) vulnerability in Sync-in Server prior to version 2.4.0. An authenticated attacker can supply a complex regular expression in the pathFilters parameter of the sync diff endpoint. When evaluated, this causes catastrophic backtracking, blocking the single-threaded Node.js event loop and rendering the entire server unresponsive.
6 views•6 min read
•about 4 hours ago•CVE-2026-56681
7.3CVE-2026-56681: Authentication Bypass via HTTP Header Spoofing in 9Router
CVE-2026-56681 is a high-severity authentication bypass vulnerability in 9Router, an AI router and token-saving proxy. The vulnerability arises from an improper trust boundary where the application relies on the client-controlled HTTP header X-9r-Real-Ip to determine whether an incoming request originates from a local (loopback) environment. In deployments where requests can reach the Next.js backend directly—bypassing the sanitizing custom-server.js wrapper—a remote, unauthenticated attacker can spoof their origin by supplying an X-9r-Real-Ip: 127.0.0.1 header.
7 views•6 min read
•about 5 hours ago•CVE-2026-56682
5.3CVE-2026-56682: Rate Limiter Lockout Bypass via Header Spoofing in 9Router
A rate limiting bypass vulnerability in 9Router versions before 0.5.6 allows unauthenticated remote attackers to circumvent the login progressive lockout mechanism. By manipulating the client-supplied X-9r-Real-Ip HTTP header, an attacker can rotate the tracking IP address, enabling unthrottled brute-force password guessing against the administrative interface.
8 views•7 min read
•about 6 hours ago•CVE-2026-58272
5.3CVE-2026-58272: Username Enumeration via Timing Side-Channel in Sync-in Server
CVE-2026-58272 is a timing side-channel vulnerability in the authentication endpoint of Sync-in Server before version 2.4.1. Unauthenticated remote attackers can distinguish between valid and invalid usernames due to asymmetric execution paths. When processing invalid usernames, the database query returns early, skipping the computationally expensive bcrypt verification path that is normally triggered for valid accounts.
9 views•7 min read
•about 7 hours ago•CVE-2026-61612
5.7CVE-2026-61612: Server-Side Request Forgery Bypass via DNS Resolution in CKAN MCP Server
An input validation bypass in the CKAN MCP Server (NPM package @aborruso/ckan-mcp-server) prior to version 0.4.108 allows remote attackers to perform Server-Side Request Forgery (SSRF). The application's server URL validation mechanism checked hostnames only as literal strings without performing pre-connection DNS resolution. An attacker can bypass these checks using hostnames that resolve to loopback, private, or link-local IP addresses, including the AWS Instance Metadata Service (IMDS). This is the third documented bypass of this protection mechanism, succeeding previous incomplete mitigations in CVE-2026-33060 and CVE-2026-53509.
8 views•7 min read
•about 21 hours ago•GHSA-JHJP-4C2Q-XMX4
8.1GHSA-JHJP-4C2Q-XMX4: Falco k8saudit Plugin Ruleset Bypass via initContainers and ephemeralContainers
A security feature bypass vulnerability in the Falco k8saudit plugin (and its cloud-specific variants) allowed privileged workloads to run undetected. This bypass occurred because the plugin's default extraction logic and rules only evaluated standard containers, completely omitting initContainers and ephemeralContainers.
6 views•6 min read
•about 22 hours ago•CVE-2026-61630
4.2CVE-2026-61630: Time-Based One-Time Password (TOTP) Reuse/Replay in nginx-ignition
nginx-ignition is a web-based user interface for managing the Nginx web server. In versions 2.33.0 through 2.35.0, the application is vulnerable to an improper authentication flaw (CWE-287) in its Multi-Factor Authentication (MFA) implementation. The stateless validation of Time-Based One-Time Passwords (TOTP) allows an attacker to reuse a captured, active verification code multiple times within the standard 30-second validity window, successfully bypassing secondary authentication checks if primary credentials are known.
10 views•5 min read
•about 23 hours ago•CVE-2026-61629
7.5CVE-2026-61629: CPU Amplification Denial of Service via ParseAcceptLanguage Underscore Bypass
A vulnerability exists in the i18n middleware of nginx-ignition, enabling CPU amplification attacks. By transmitting a crafted Accept-Language header containing malformed tags separated by underscores, an unauthenticated remote attacker can bypass the length-guard threshold of the underlying Go parsing library. Normalization of underscores to hyphens occurs after the initial validation checks, forcing the parser into expensive quadratic-time loops that consume 100% of available CPU resources. This leads to a complete denial of service for the administrative API and potentially degrades the availability of the hosting system. This vulnerability has been resolved in version 2.40.1.
7 views•7 min read
•about 24 hours ago•CVE-2026-61628
8.1CVE-2026-61628: Unauthenticated Admin Account Creation via Onboarding Race Condition in Nginx Ignition
Nginx Ignition prior to version 2.41.1 contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its unauthenticated onboarding API endpoint. This flaw allows remote, unauthenticated attackers to register an administrative account by sending concurrent HTTP requests during the initial system configuration phase, bypassing the check meant to restrict onboarding to a single initial administrator.
11 views•6 min read
•1 day ago•CVE-2026-61687
7.1CVE-2026-61687: OAuth State Validation Bypass and Login CSRF in Hatchet
A logic error in Hatchet's OAuth state validation mechanism allows unauthenticated remote attackers to bypass state parameter verification. By submitting an empty state parameter, attackers can exploit an equality collision with cleared session keys, facilitating Login Cross-Site Request Forgery (Login CSRF) or Session Fixation.
10 views•10 min read