vulnerability

101 pieces of writing

MarSeventh/CloudFlare-ImgBed PR #625 blocked SSRF in fetchRes

MarSeventh/CloudFlare-ImgBed exposed an authenticated server-side URL proxy through fetchRes. PR #625 adds URL validation, private address blocking and redirect revalidation.

15 July 2026

security12 min read

Gogs, PraisonAI and KnowledgeDeliver show authentication bypass is a self-hosted platform design failure

2 June 2026

vulnerability8 min read

maboloshi/github-chinese PR #692 fixed DOM XSS in translation results

17 May 2026

vulnerability7 min read

RAGFlow PR #14803 removed a CWE-502 pickle RCE footgun from deserialize_b64

RAGFlow's deserialize_b64 helper defaulted to bare pickle.loads behind an unset safety flag. PR #14803 makes RestrictedUnpickler the only path.

15 May 2026

vulnerability9 min read

getsentry/XcodeBuildMCP PR #289 hardens shell escaping in MCP tool execution

14 May 2026

vulnerability9 min read

AReaL PR #1323 refuses the default admin API key on network-facing proxy binds

11 May 2026

vulnerability7 min read

Harbor PR #236 blocks CWE-78 in remote profile downloads

Harbor accepted remotely downloaded profile values that could later be expanded through eval, allowing command injection through a configuration import path. PR #236 adds validation before remote profiles are installed.

9 May 2026

vulnerability7 min read

Softeria ms-365-mcp-server PR #456 validates redirect_uri before Microsoft Entra forwarding

9 May 2026

vulnerability7 min read

CodeGraphContext PR #882 rejects write Cypher on /api/graph

8 May 2026

vulnerability7 min read

mcp-searxng PR #71 fixed a CWE-1333 ReDoS in section extraction

mcp-searxng interpolated the user-controlled section parameter into a dynamically built regular expression, allowing a malicious MCP client to block the Node.js event loop.

29 April 2026

vulnerability6 min read

NVIDIA's RAG Blueprint had a path traversal in its MCP server. We got the fix merged in three days.

12 April 2026

security11 min read

Seven authentication bypasses that keep shipping in 2025 and 2026: the same architectural antipatterns, rewritten in new frameworks

7 April 2026

ics8 min read

CVE-2025-10492: a Java deserialisation flaw in JasperReports gives attackers remote code execution on Hitachi Energy Ellipse

CVE-2025-10492, a CVSS 9.8 Java deserialisation flaw in the JasperReports component of Hitachi Energy Ellipse, enables unauthenticated RCE on critical manufacturing systems. No patch exists for the community edition of the underlying library.

6 April 2026

vulnerability5 min read

Edict's file:// handler let anyone read files outside the project directory (CWE-22)

5 April 2026

vulnerability5 min read

AIPex's localhost daemon let any website control your browser through a WebSocket

3 April 2026

Weekly digests

vulnerability

MarSeventh/CloudFlare-ImgBed PR #625 blocked SSRF in fetchRes

Gogs, PraisonAI and KnowledgeDeliver show authentication bypass is a self-hosted platform design failure

maboloshi/github-chinese PR #692 fixed DOM XSS in translation results

RAGFlow PR #14803 removed a CWE-502 pickle RCE footgun from deserialize_b64

getsentry/XcodeBuildMCP PR #289 hardens shell escaping in MCP tool execution

AReaL PR #1323 refuses the default admin API key on network-facing proxy binds

Harbor PR #236 blocks CWE-78 in remote profile downloads

Softeria ms-365-mcp-server PR #456 validates redirect_uri before Microsoft Entra forwarding

CodeGraphContext PR #882 rejects write Cypher on /api/graph

mcp-searxng PR #71 fixed a CWE-1333 ReDoS in section extraction

NVIDIA's RAG Blueprint had a path traversal in its MCP server. We got the fix merged in three days.

Seven authentication bypasses that keep shipping in 2025 and 2026: the same architectural antipatterns, rewritten in new frameworks

CVE-2025-10492: a Java deserialisation flaw in JasperReports gives attackers remote code execution on Hitachi Energy Ellipse

Edict's file:// handler let anyone read files outside the project directory (CWE-22)

AIPex's localhost daemon let any website control your browser through a WebSocket

Weekly threat intelligence digest — 2026-W30

Weekly threat intelligence digest — 2026-W29

Weekly threat intelligence digest — 2026-W26

Weekly threat intelligence digest — 2026-W25

Weekly threat intelligence digest — 2026-W23

Weekly threat intelligence digest — 2026-W22

Weekly threat intelligence digest — 2026-W21

Weekly threat intelligence digest — 2026-W20

Weekly threat intelligence digest — 2026-W19

Weekly threat intelligence digest — 2026-W17

Weekly threat intelligence digest — 2026-W16

Weekly threat intelligence digest — 2026-W15

Weekly threat intelligence digest — 2026-W14

Weekly threat intelligence digest — 2026-W13

Weekly threat intelligence digest — 2026-W12

Weekly threat intelligence digest — 2026-W11

Weekly threat intelligence digest — 2026-W10

Weekly threat intelligence digest — 2026-W09

Weekly threat intelligence digest — 2026-W08

Weekly threat intelligence digest — 2026-W07

Weekly threat intelligence digest — 2026-W06

Weekly threat intelligence digest — 2026-W05

Weekly threat intelligence digest — 2026-W04

Weekly threat intelligence digest — 2026-W03

Weekly threat intelligence digest — 2026-W02

Weekly threat intelligence digest — 2025-W52

Weekly threat intelligence digest — 2025-W51

Weekly threat intelligence digest — 2025-W50

Weekly threat intelligence digest — 2025-W49

Weekly threat intelligence digest — 2025-W48

Weekly threat intelligence digest — 2025-W47

Weekly threat intelligence digest — 2025-W46

Weekly threat intelligence digest — 2025-W45

Weekly threat intelligence digest — 2025-W44

Weekly threat intelligence digest — 2025-W43

Weekly threat intelligence digest — 2025-W42

Weekly threat intelligence digest — 2025-W41

Weekly threat intelligence digest — 2025-W40

Weekly threat intelligence digest — 2025-W39

Weekly threat intelligence digest — 2025-W38

Weekly threat intelligence digest — 2025-W37

Weekly threat intelligence digest — 2025-W36

Weekly threat intelligence digest — 2025-W35

Weekly threat intelligence digest — 2025-W34

Weekly threat intelligence digest — 2025-W33

Weekly threat intelligence digest — 2025-W32

Weekly threat intelligence digest — 2025-W31

Weekly threat intelligence digest — 2025-W30

Weekly threat intelligence digest — 2025-W29

Weekly threat intelligence digest — 2025-W28

Weekly threat intelligence digest — 2025-W27

Weekly threat intelligence digest — 2025-W26

Weekly threat intelligence digest — 2025-W25

Weekly threat intelligence digest — 2025-W24

Weekly threat intelligence digest — 2025-W23

Weekly threat intelligence digest — 2025-W21

Weekly threat intelligence digest — 2025-W20

Weekly threat intelligence digest — 2025-W19

Weekly threat intelligence digest — 2025-W17

Weekly threat intelligence digest — 2025-W16

Weekly threat intelligence digest — 2025-W15

Weekly threat intelligence digest — 2025-W13

Weekly threat intelligence digest — 2025-W12

Weekly threat intelligence digest — 2025-W11