Dreigingen

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

CVE-2026-46338

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

CVE-2026-45805

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

FPDI: Memory Exhaustion and Endless Loop in FPDI leads to Denial of Service

CVE-2026-45802

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

CVE-2026-45799

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

CVE-2026-45796

HAX CMS: Denial of Service using Malicious Import Request

HAX CMS: Denial of Service using Malicious Import Request

CVE-2026-46357

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle

CVE-2026-45785

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

CVE-2026-45784

Trubo: Login callback CSRF/session fixation

Trubo: Login callback CSRF/session fixation

CVE-2026-45773

Turbo: Unexpected local code execution during Yarn Berry detection

Turbo: Unexpected local code execution during Yarn Berry detection

CVE-2026-45772

FBI: Americans lost over $388 million to scams using crypto ATMs in 2025

The FBI says Americans have lost over $388 million last year to scams using cryptocurrency kiosks, also known as crypto ATMs or Bitcoin ATMs. [...]

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path