genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport
CVE-2026-55637
`genieacs-mcp` exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled `Host` and `Origin` headers
2026-08-26 归档
今日共收录 1656 条安全情报，包含 834 个 CVE，420 篇安全通告，以及 108 篇研究论文。
← 返回归档列表Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts
CVE-2026-55092
## Summary When Trivy downloads an OCI artifact, it uses the `org.opencontainers.image.title` annotation from the artif
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
CVE-2026-55596
## Summary The media embed renderer trusts serialized `provider` or `sourceUrl` metadata and skips the URL protocol val
browse-mcp has an arbitrary file write via unconfined download and state paths
CVE-2026-55557
### Impact `browser_download` wrote a fetched file to `join(save_dir, filename)` with no validation of `save_dir`, and `
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud
Sign Up for Free Cloud Tier
Sign Up for Free Cloud Tier
iOS 26.4.2 and iPadOS 26.4.2
iOS 26.4.2 and iPadOS 26.4.2
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.8 and iPadOS 18.7.8
iOS 18.7.7 and iPadOS 18.7.7
iOS 18.7.7 and iPadOS 18.7.7
iOS 26.4 and iPadOS 26.4
iOS 26.4 and iPadOS 26.4
Background Security Improvements for iOS, iPadOS, and macOS
Background Security Improvements for iOS, iPadOS, and macOS
iOS 16.7.15 and iPadOS 16.7.15
iOS 16.7.15 and iPadOS 16.7.15
iOS 15.8.7 and iPadOS 15.8.7
iOS 15.8.7 and iPadOS 15.8.7
iOS 26.3 and iPadOS 26.3
iOS 26.3 and iPadOS 26.3
iOS 18.7.5 and iPadOS 18.7.5
iOS 18.7.5 and iPadOS 18.7.5
iOS 26.2 and iPadOS 26.2
iOS 26.2 and iPadOS 26.2
iOS 18.7.3 and iPadOS 18.7.3
iOS 18.7.3 and iPadOS 18.7.3
Compressor 4.11.1
Compressor 4.11.1
Android Code Search
Android Code Search