•28 minutes ago•CVE-2026-54603
8.6CVE-2026-54603: Cross-Origin Credential Leakage and SSRF via Protocol-Relative Redirects in ruby-oauth2
An issue in the ruby-oauth2 gem allows unauthenticated attackers to steal OAuth access tokens or perform Server-Side Request Forgery (SSRF) via a protocol-relative URI in HTTP Location redirect headers.
0 views•7 min read
•about 2 hours ago•CVE-2026-54609
8.6CVE-2026-54609: Uncontrolled Resource Consumption and Network Amplification in QTINeon
Quiet-Terminal-Interactive's QTINeon version 1.0.0 is vulnerable to uncontrolled resource consumption and relay-to-host network amplification. The reconnect request handler lacks table size constraints, rate limiting, and request deduplication, allowing unauthenticated attackers to crash the relay server and overwhelm target hosts.
5 views•5 min read
•about 2 hours ago•CVE-2026-54635
7.5CVE-2026-54635: Authentication Bypass via Custom Webhook Paths in pytonapi
An authentication bypass vulnerability exists in the pytonapi library when custom paths are registered in the TonapiWebhookDispatcher. The application fails to retrieve or store secure tokens for custom paths, leading to a fail-open authorization check that allows unauthenticated remote attackers to send spoofed webhook events directly to internal handlers.
3 views•6 min read
•about 3 hours ago•CVE-2026-54588
9.6CVE-2026-54588: Account Takeover via Host Header Injection in Poweradmin Authentication
Poweradmin is affected by a critical Host Header Injection vulnerability within its Single Sign-On (SSO) and logout authentication mechanisms. The application dynamically constructs external redirection and callback URLs using the client-controlled HTTP Host header. An unauthenticated attacker can exploit this behavior to poison OAuth and SAML callback parameters, redirecting authentication credentials directly to a malicious external server. This allows full administrative account takeover without credentials when a victim accesses a manipulated authentication link.
5 views•7 min read
•about 4 hours ago•GHSA-HC4M-Q9JH-XW4J
6.6GHSA-hc4m-q9jh-xw4j: Registry Pack Verification Fail-Open Vulnerability in nono-cli
The nono-cli package verification mechanism fails open when both the lockfile entry and local trust bundle are absent. This allows local attackers to execute unverified package profiles and native host session hooks by removing metadata configurations, bypassing cryptographic integrity controls.
5 views•5 min read
•about 10 hours ago•CVE-2026-5326
5.3CVE-2026-5326: Insecure Direct Object Reference (IDOR) in SourceCodester Leave Application System
An Insecure Direct Object Reference (IDOR) vulnerability exists in SourceCodester Leave Application System 1.0 within the User Information Handler component. The application processes client-supplied database identifiers via URL parameters without executing proper authorization checks or session validation. This allows remote, unauthenticated attackers to view sensitive administrative and employee records by altering the 'id' parameter.
6 views•5 min read
•3 days ago•GHSA-7PPR-R889-MCF2
7.5GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service
An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.
7 views•5 min read
•3 days ago•GHSA-95CV-R8X4-VH75
7.6GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler
A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.
10 views•7 min read
•3 days ago•GHSA-P6PH-3JX2-3337
4.3GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList
OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.
8 views•5 min read
•3 days ago•GHSA-86CX-WWF4-PHQ4
6.5GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList
An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.
8 views•6 min read
•3 days ago•CVE-2026-16584
7.0CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure
A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.
12 views•7 min read
•3 days ago•GHSA-6V4M-FW66-8R4X
6.5GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape
An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.
6 views•7 min read