•39 minutes ago•GHSA-3WHF-VGF2-9W6G
5.1GHSA-3WHF-VGF2-9W6G: Denial of Service via Unbounded Recursion and State Panic in zaino-state
The zaino-state crate contains two critical flaws in its block reorganization and state synchronization logic. An unbounded recursive async function handling block reorganization fails to validate cyclic relationships, enabling network peers to cause infinite loops that exhaust CPU and memory resources. Furthermore, a logical pruning error during non-finalized block cache trimming can purge all cached blocks, triggering an immediate panic and crash of the daemon.
2 views•6 min read
•about 2 hours ago•CVE-2026-53504
7.5CVE-2026-53504: Regular Expression Denial of Service (ReDoS) in Thumbor Convolution Filter
A critical Regular Expression Denial of Service (ReDoS) vulnerability exists in Thumbor prior to version 7.8.0. The vulnerability resides within the dynamic filter-parsing engine, specifically inside the 'convolution' filter parameter processing logic. Due to overlapping and nested quantifiers in the regular expression used to parse matrix values, a remote, unauthenticated attacker can supply a specially crafted, malformed filter payload inside a request URL. This causes Python's standard NFA-based regular expression engine to undergo exponential backtracking, exhausting CPU resources and leading to a complete Denial of Service.
5 views•6 min read
•about 3 hours ago•CVE-2026-54737
7.3CVE-2026-54737: Prototype Pollution in @phun-ky/defaults-deep
CVE-2026-54737 is a high-severity Prototype Pollution vulnerability in the @phun-ky/defaults-deep npm library prior to version 2.0.5. Due to unsafe recursive object merging, unauthenticated attackers can supply structured payloads that modify the properties of Object.prototype, compromising the runtime process state.
6 views•5 min read
•about 4 hours ago•CVE-2026-54729
8.7CVE-2026-54729: SSRF Protection Bypass in dssrf-js via NXDOMAIN Resolution Discrepancy
CVE-2026-54729 is a critical Server-Side Request Forgery (SSRF) bypass vulnerability in the dssrf-js Node.js library prior to version 1.0.5. The flaw occurs because the library's DNS validation mechanism incorrectly treats domains like 'localhost' as safe when the configured upstream DNS resolver returns NXDOMAIN. Since the system's HTTP client later falls back to OS-level resolution (resolving 'localhost' to '127.0.0.1'), attackers can bypass validation and access internal loopback addresses.
5 views•6 min read
•about 5 hours ago•GHSA-XRMJ-5G4G-8987
4.2GHSA-xrmj-5g4g-8987: Workflow Template Injection in @dynatrace-oss/dynatrace-mcp-server
A template injection vulnerability in @dynatrace-oss/dynatrace-mcp-server allows untrusted input to be interpolated directly into Dynatrace Workflows using Jinja2 syntax, leading to persistent data exposure and exfiltration.
7 views•5 min read
•about 11 hours ago•CVE-2026-67437
7.5CVE-2026-67437: Unauthenticated Denial of Service via OAuth2 State Memory Exhaustion in OliveTin
An uncontrolled resource consumption vulnerability (CWE-400) in OliveTin allows unauthenticated remote attackers to exhaust server memory and trigger a denial of service (DoS). By repeatedly initiating the OAuth2 login flow without completing it, attackers can force the server to allocate state variables in an unbounded in-memory map. This heap-based resource exhaustion eventually causes the host operating system to terminate the OliveTin process via the Out-Of-Memory (OOM) killer.
7 views•8 min read
•about 12 hours ago•CVE-2026-67439
4.3CVE-2026-67439: Incorrect Authorization Leading to Log Leak in OliveTin
An incorrect authorization vulnerability (CWE-863) exists in OliveTin prior to version 3000.17.0. The flaw allows authenticated users who are authorized to execute commands but restricted from viewing logs to bypass this restriction. By utilizing synchronous endpoints, attackers can directly access execution outputs containing sensitive system data, credentials, and environmental configurations.
7 views•5 min read
•about 13 hours ago•CVE-2026-67438
6.6CVE-2026-67438: OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check in OliveTin
An OS command injection vulnerability exists in OliveTin versions >= 3000.2.0 and < 3000.17.0. The flaw stems from a validation bypass in the shell safety engine, which fails to recognize custom regular expression arguments as unsafe for actions run in shell execution mode. Furthermore, because these custom regex checks evaluate partial string matches, attackers can append arbitrary shell metacharacters to valid inputs. This allows unauthenticated or low-privilege users who are authorized to run configured actions to inject shell commands and achieve arbitrary remote code execution on the host system.
6 views•6 min read
•about 14 hours ago•CVE-2026-63118
6.9CVE-2026-63118: DNS-Rebinding and Cross-Origin Request Execution in Model Context Protocol (MCP) Ruby SDK
A critical vulnerability (CVE-2026-63118) in the Model Context Protocol (MCP) Ruby SDK allows attackers to execute arbitrary JSON-RPC commands and exfiltrate sensitive local data from an MCP server bound to the local loopback interface. This is achieved through DNS-rebinding and cross-origin request execution due to missing validation of the HTTP Host and Origin headers in the StreamableHTTPTransport component.
7 views•6 min read
•about 16 hours ago•CVE-2026-63119
6.2CVE-2026-63119: Denial of Service via Uncontrolled Resource Consumption in Model Context Protocol Ruby SDK
CVE-2026-63119 is a high-impact denial-of-service vulnerability in the Model Context Protocol (MCP) Ruby SDK (distributed as the 'mcp' gem) before version 0.23.0. The vulnerability allows an attacker to cause resource exhaustion and process termination by streaming unbounded input to standard I/O streams.
6 views•6 min read
•about 17 hours ago•CVE-2026-67430
5.3CVE-2026-67430: Denial of Service via Unbounded Session Retention in Model Context Protocol Ruby SDK
CVE-2026-67430 is a medium-severity Denial of Service (DoS) vulnerability in the Model Context Protocol (MCP) Ruby SDK (packaged as the mcp gem) versions prior to 0.23.0. In stateful deployments using the StreamableHTTPTransport class, client session states are retained in an in-memory hash map. Because the transport implements a nil idle timeout by default, the background scavenger process is suppressed. Remote, unauthenticated attackers can flood the endpoint with initialize requests, rapidly consuming system memory and triggering an Out-of-Memory (OOM) crash.
7 views•8 min read
•about 18 hours ago•CVE-2026-67432
7.5CVE-2026-67432: High Severity Denial of Service in Model Context Protocol (MCP) Ruby SDK
An uncontrolled memory allocation vulnerability (CWE-770) exists in the Model Context Protocol (MCP) Ruby SDK (the `mcp` gem) prior to version 0.23.0. The SDK's StreamableHTTPTransport and StdioTransport layers fail to impose bounds on incoming payloads. An unauthenticated attacker can exploit these issues by transmitting massive, nested payloads to exhaust worker memory, leading to process termination.
4 views•7 min read