🚨 UpSnap Fresh Installs Exposed to Unauthenticated Root RCE
UpSnap operators should upgrade to 5.4.0 immediately, especially for fresh or network-reachable deployments. The combination of unauthenticated superuser creation and root command execution makes this a top-priority patch.
CVE-2026-49819 affects UpSnap versions 4.4.1 through 5.3.5 and carries a CVSS 9.8 CRITICAL rating. An unauthenticated attacker can register the initial superuser on a fresh installation through the unprotected init-superuser endpoint, obtain a long-lived JWT, and pivot to root remote code execution through unsafe shell command execution. Version 5.4.0 fixes the issue.
🔗 Read more 🔗
Source: NVD
🔐 Cedar Express Middleware Flaw Can Bypass Route Authorization
Teams using this Cedar middleware with overlapping Express route prefixes and different permission levels should patch urgently and review authorization tests. Until updated, validate request paths before authorization and avoid relying on this middleware as the sole authorization control.
CVE-2026-49473 affects @cedar-policy/authorization-for-expressjs versions prior to 0.3.0 and is rated CVSS 8.8 HIGH. The middleware can authorize requests using req.originalUrl including its query string while Express routes only on the path, allowing crafted query strings to select a less restrictive Cedar action for a more privileged endpoint. The entry states that the issue has been addressed in version 0.30.
🔗 Read more 🔗
Source: NVD
🌐 MRBS Vulnerable to Server-Side Request Forgery
MRBS administrators should upgrade to 1.12.2 promptly. Because there is no known workaround, systems that can reach sensitive internal services deserve particularly urgent attention.
CVE-2026-46382 affects the Meeting Room Booking System prior to version 1.12.2 and is rated CVSS 8.7 HIGH. A user-supplied private or local URI can be fetched without appropriate checks, exposing the application to server-side request forgery behavior. Version 1.12.2 fixes the vulnerability, and no known workarounds are available.
🔗 Read more 🔗
Source: NVD
🌍 OpenStack Designate Flaw Enables Cross-Tenant DNS Hijacking
OpenStack operators running multi-pool Designate with AttributeFilter enabled should treat this as urgent and upgrade to 22.0.1 or later. The risk is especially serious in shared environments because one tenant can interfere with another tenant’s DNS.
CVE-2026-71193 affects OpenStack Designate before 22.0.1 and is rated CVSS 9.6 CRITICAL. In multi-pool deployments using the AttributeFilter scheduler, an authenticated user can place overlapping DNS zones in another pool and bypass zone-conflict checks. This can enable cross-tenant DNS hijacking or DNS denial of service.
🔗 Read more 🔗
Source: NVD
💥 UpSnap Device Fields Allow Authenticated Command Injection
Any UpSnap deployment with multiple users or delegated device-management permissions should upgrade to 5.4.0 immediately. Low-privileged device-management access is enough to turn this flaw into host-level remote code execution.
CVE-2026-49481 affects UpSnap versions prior to 5.4.0 and is rated CVSS 9.6 CRITICAL. Unsafe interpolation of user-controlled IP and MAC fields into shell command templates allows a low-privileged authenticated user who can create or edit devices to execute arbitrary operating system commands on the UpSnap host. Version 5.4.0 patches the issue.
🔗 Read more 🔗
Source: NVD
🏭 FUXA Guest Requests Can Expose Sensitive SCADA Project Data
FUXA operators should update to 1.3.1 promptly, especially where the interface is reachable by untrusted users or networks. Sensitive SCADA or HMI project configuration should not be exposed to guest-context requests.
CVE-2026-47717 affects fuxa-server version 1.3.0 and is rated CVSS 7.5 HIGH. The GET /api/project endpoint can expose sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
🔗 Read more 🔗
Source: NVD
🔑 WolfStack Hard-Coded Secret Opens the Door to Container Root Access
WolfStack administrators should upgrade to 25.9.2 or later immediately and restrict management-port exposure. The shared hard-coded authentication secret can remove the intended authentication barrier from highly privileged container-management operations.
CVE-2026-73519 affects WolfStack before 25.9.2 and is rated CVSS 9.8 CRITICAL. A hard-coded cluster authentication secret compiled into every build allows remote unauthenticated attackers who can reach the management port to bypass authentication. Attackers can enumerate Docker and LXC containers and execute arbitrary commands as root inside them.
🔗 Read more 🔗
Source: NVD
🛡️ kin-openapi Authentication Fallback Can Silently Allow Protected Requests
Go services using kin-openapi ValidationHandler for access enforcement should upgrade to 0.144.0 urgently and verify that authentication callbacks are explicitly configured. This flaw can cause authorization-sensitive requests to fail open when the authentication function is missing.
CVE-2026-73501 affects kin-openapi prior to 0.144.0 and is rated CVSS 9.1 CRITICAL. ValidationHandler.Load() can silently replace a missing AuthenticationFunc with a no-op implementation, causing OpenAPI security requirements to be treated as satisfied for unauthenticated requests. Applications relying on ValidationHandler as their enforcement layer can therefore expose handlers protected by API keys, OAuth, or other schemes.
🔗 Read more 🔗
Source: NVD
🧵 etcd TLS Handshake Exhaustion Can Take Down Cluster Availability
etcd and Kubernetes operators should prioritize upgrades to 3.5.33, 3.6.14, or 3.7.1 as appropriate, particularly where TLS listeners are reachable from broad network segments. Network filtering can reduce exposure, but patching is the durable fix.
CVE-2026-73500 affects etcd prior to versions 3.5.33, 3.6.14, and 3.7.1 and is rated CVSS 8.7 HIGH. A network attacker able to reach an etcd TLS listener can open many connections without sending a ClientHello, leaving goroutines blocked indefinitely and growing the pending-connection map. Memory exhaustion can crash etcd and potentially disrupt a Kubernetes control plane backed by the affected cluster.
🔗 Read more 🔗
Source: NVD
👀 etcd Watch API Can Leak Keys Beyond RBAC Permissions
Authenticated etcd deployments using granular RBAC should upgrade promptly to 3.5.33, 3.6.14, or 3.7.1. Review accounts with narrowly scoped read permissions because they may have been able to observe watch events outside their intended key scope.
CVE-2026-73499 affects etcd prior to versions 3.5.33, 3.6.14, and 3.7.1 and is rated CVSS 7.1 HIGH. A user with READ permission on one exact key can abuse the Watch gRPC API with WithFromKey() to receive events for all lexicographically subsequent keys because the range is mishandled before the RBAC permission check. The flaw affects clusters with authentication enabled and does not affect Range/Get or DeleteRange requests.
🔗 Read more 🔗
Source: NVD
📎 MCP Atlassian Attachment Tool Can Exfiltrate Server Files
MCP Atlassian users should upgrade to 0.22.0 promptly and closely restrict which clients or agents can invoke attachment tools. Agent deployments that process untrusted content deserve extra urgency because induced tool calls could expose files and credentials accessible to the server process.
CVE-2026-73498 affects MCP Atlassian prior to 0.22.0 and is rated CVSS 7.7 HIGH. The confluence_upload_attachment tool passes a client-controlled file path directly to the filesystem without safe-path validation, allowing an authenticated MCP client to read files available to the server process and upload them to Confluence. If an AI agent is induced to invoke the tool through untrusted content, credentials such as CONFLUENCE_API_TOKEN may also be exposed.
🔗 Read more 🔗
Source: NVD
📨 Blaze HTTP Trailers Can Reintroduce Trusted Headers
http4s deployments using BlazeServerBuilder behind proxies should upgrade to 0.23.18 or 1.0.0-M42 promptly, especially when application logic trusts forwarded or internal headers. Review proxy handling of HTTP trailers as an additional defensive measure.
CVE-2026-73495 affects blaze-server prior to 0.23.18 and 1.0.0-M42 and is rated CVSS 7.4 HIGH. HTTP/1.1 chunked-body trailer fields can be merged into Request.headers, letting unauthenticated attackers inject headers such as X-Forwarded-For or internal authorization headers that a reverse proxy previously removed or normalized. Applications trusting proxy-set headers can therefore suffer IP spoofing, authorization bypasses, audit manipulation, or attacker-controlled connection termination.
🔗 Read more 🔗
Source: NVD