•about 2 hours ago•CVE-2026-73843
9.6CVE-2026-73843: Critical Missing Authentication and Privilege Escalation in OpenChoreo Cluster Gateway
Prior to versions 1.0.2 and 1.1.2, OpenChoreo's cluster gateway combined public agent traffic and administrative control-plane APIs on a single TCP port (8443). Exposing this port allowed external unauthenticated actors to access sensitive proxy and execution interfaces.
6 views•7 min read
•about 3 hours ago•CVE-2026-73841
8.8CVE-2026-73841: Broken Object Level Authorization (BOLA) in OpenChoreo Container Exec and Wirelogs Endpoints
An Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA) vulnerability in OpenChoreo allows authenticated users with project-level permissions to bypass tenant boundaries. By manipulating client-controlled query parameters, an attacker can execute arbitrary commands inside Kubernetes containers or view sensitive communication streams of resources belonging to other, highly privileged projects within the same namespace.
2 views•7 min read
•about 4 hours ago•CVE-2026-73840
5.3CVE-2026-73840: Unauthenticated Webhook Signature Bypass and Git-Provider Confusion in OpenChoreo
An authentication bypass and logical confusion vulnerability exists in the OpenChoreo Kubernetes developer platform webhook ingestion system. By exploiting a combination of git-provider spoofing, a missing signature validation requirement on Bitbucket webhooks, and a lack of source-host mapping checks, unauthenticated network attackers can trigger unauthorized builds on arbitrary repositories.
3 views•5 min read
•about 5 hours ago•CVE-2026-73667
8.8CVE-2026-73667: Remote Code Execution via OS Command Injection in OpenChoreo Workflow Plane
An authenticated remote code execution vulnerability exists in the OpenChoreo developer platform's Workflow Plane templates. The flaw occurs due to server-side string interpolation of workflow parameters into inline shell scripts and insecure shell parameter expansion. This allows low-privileged attackers to execute arbitrary shell commands inside privileged containers, leading to potential host privilege escalation.
4 views•7 min read
•about 5 hours ago•CVE-2026-84366
7.4CVE-2026-84366: Plaintext AWS Credential Exposure in Scrapy S3DownloadHandler
A security vulnerability in Scrapy's Amazon S3 download handler allows unencrypted transmission of sensitive AWS credentials and session tokens over plaintext HTTP. Prior to version 2.17.0, the handler defaulted to HTTP instead of HTTPS when translating s3:// URIs into standard S3 API requests, unless explicitly configured otherwise. This allows network eavesdroppers to intercept credentials and perform active Man-in-the-Middle (MITM) attacks.
4 views•5 min read
•about 7 hours ago•CVE-2026-62674
9.0CVE-2026-62674: Shared Agent Bundle Overwrite Leads to Authenticated Runner Remote Code Execution in omnigent
A critical validation flaw in the backend of the omnigent framework prior to version 0.3.0 allows authenticated users to overwrite the global shared agent bundle, leading to remote code execution on the runner process through malicious stdio MCP server configurations.
4 views•7 min read
•about 8 hours ago•CVE-2026-63311
6.9CVE-2026-63311: Server-Side Request Forgery and DNS Rebinding in Natural Language Toolkit (NLTK)
A vulnerability in the Natural Language Toolkit (NLTK) before version 3.10.0 allowed attackers to bypass SSRF filters via DNS resolution failures and DNS rebinding. By exploiting these weaknesses, unauthenticated remote attackers could coerce hosting systems into scanning internal networks or accessing sensitive cloud metadata endpoints.
3 views•6 min read
•about 9 hours ago•CVE-2026-62388
7.5CVE-2026-62388: Insecure Default Security Enforcement in Natural Language Toolkit (NLTK) Path Security Module
CVE-2026-62388 represents a critical design flaw in the Natural Language Toolkit (NLTK) before version 3.10.0. The central security module (`nltk/pathsec.py`) initialized its validation enforcement flag to false by default. This fail-open configuration rendered security controls—such as path traversal checks, zip archive audits, and SSRF validations—non-blocking, only emitting warnings while permitting arbitrary file operations and code execution.
4 views•6 min read
•about 9 hours ago•CVE-2026-76172
7.5CVE-2026-76172: Parser Differential and Host Confusion in fast-uri
A critical parser differential and host confusion vulnerability (CVE-2026-76172) exists in fast-uri, a dependency-free URI validation and normalization library for Node.js. This vulnerability stems from improper validation of the URI scheme component after decoding percent-encoded characters using the legacy global unescape() function. This allows structural characters such as path delimiters and control characters to be written raw into the output stream during serialization, causing host confusion, Server-Side Request Forgery (SSRF), or HTTP response splitting downstream.
8 views•6 min read
•about 10 hours ago•CVE-2026-75899
7.5CVE-2026-75899: Double-Decoding Host Bypass and SSRF in fast-uri
A double-decoding vulnerability in the fast-uri package allows unauthenticated remote attackers to bypass host-policy validation and conduct Server-Side Request Forgery (SSRF) attacks by submitting nested percent-encoded URI strings.
5 views•6 min read
•about 11 hours ago•CVE-2026-75975
7.5CVE-2026-75975: Server-Side Request Forgery (SSRF) and Address-Policy Bypass via Malformed IPv6 Parser in fast-uri
A critical parser differential vulnerability in the Node.js fast-uri library allows unauthenticated remote attackers to bypass address-validation filters and perform Server-Side Request Forgery (SSRF). The library fails to validate complete IPv6 grammar inside bracketed literals, silently truncating invalid trailing characters and normalising malformed hosts into valid loopback or private addresses.
5 views•7 min read
•about 12 hours ago•CVE-2026-75931
7.5CVE-2026-75931: Host Confusion and SSRF Bypass via Scheme-Relative URIs in fast-uri
A host confusion vulnerability exists in the fast-uri Node.js library when parsing scheme-relative URI references. Due to inconsistent domain name canonicalization, applications validating resolved hosts can be bypassed by downstream WHATWG-compliant parsers, facilitating Server-Side Request Forgery (SSRF).
6 views•7 min read