CVE-2026-97363 is a vulnerability in the Monta monta.app WebSocket API where there are no restrictions on the number of authentication requests. This lack of rate limiting can enable attackers to perform denial-of-service or brute-force attacks. The vulnerability has a high severity rating with a CVSS score of 7.5, primarily impacting availability. No affected versions or patches are explicitly stated in the available data.
CVE-2026-97212 is a vulnerability in Monta's monta.app where the WebSocket backend uses predictable session identifiers by allowing multiple endpoints to connect using the same charging station identifier. This flaw can enable unauthorized users to impersonate others or cause denial-of-service by flooding the backend with valid session requests. The vulnerability has a high severity rating with a CVSS score of 7.3.
CVE-2026-93474 is a medium severity vulnerability in Monta's monta.app where charging station authentication identifiers are publicly accessible through web-based mapping platforms. This exposure could allow unauthorized parties to access or misuse these identifiers. The vulnerability has a CVSS score of 6.5, indicating a moderate risk with low attack complexity and no required privileges or user interaction.
CVE-2026-104874 is a medium severity memory leak vulnerability in aio-libs/multidict versions 6.7.0 through 6.9.0. It occurs in the items-view union and subtraction operators, where certain references are not properly released, causing unbounded memory growth. This leak can be triggered remotely by supplying crafted HTTP headers or query strings to servers using the affected library. The issue results in increasing resident memory usage until the process is terminated.
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might allow an authenticated remote user with project contributor permissions to execute arbitrary commands in another project member's Studio Space and obtain that member's temporary execution role credentials via a crafted connection resource property that is interpolated into a shell invocation without neutralization.
To remediate this issue, users should upgrade to version 2.14.12, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.5, or 4.4.3, as applicable to the minor line in use. Users on minor lines that have reached end of support must move to a supported minor line, because no patched version will be released for those lines. In Amazon SageMaker Unified Studio, Studio Spaces adopt the latest patch of their minor line on restart once the patched images are deployed, so no version selection is required.
CVE-2026-104873 is an incorrect authorization vulnerability in the langgraph Python SDK used by langchain-ai. Versions from 0.1.45 up to but not including 0.4.4 have resource-scoped authorization decorators that ignore the actions argument, causing a wildcard handler to be selected for all actions. This allows authenticated users to bypass permission checks and access or modify other users' resources. The issue is fixed in version 0.4.4.
CVE-2026-103918 is a medium severity vulnerability in the middleapi orpc package affecting the ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin. These plugins improperly handle object keys that match Object.prototype members, allowing an attacker to replace the prototype of a coerced input object or cause unhandled TypeErrors by sending keys like 'constructor'. The issue is limited to the request payload and does not affect global state or other requests. It is fixed in version 1.14.10.
CVE-2026-103036 is a medium severity vulnerability in the orpc component of middleapi prior to version 1.14.9. It involves improper control of dynamically-determined object attributes during JSON schema coercion, allowing a remote client to supply crafted __proto__ or Object.prototype properties that influence the behavior of the coerced request object. This can affect handler logic and configuration lookups without modifying global objects or other users' requests. The issue is fixed in version 1.14.9.
CVE-2026-104994 is a path traversal vulnerability in aquasec Trivy before version 0.71.0. It allows directory traversal in Terraform filesystem functions during misconfiguration scanning, potentially exposing sensitive data located outside the intended scan root. This risk arises when scanning untrusted input, such as third-party pull requests containing Terraform configurations. The vulnerability has a low CVSS score of 2.5 and requires local access with low privileges and high attack complexity.
OpenTelemetry JavaScript Contrib instrumentation libraries prior to specified versions include the database connection username in telemetry data as the db.user span attribute by default. This sensitive information is logged and sent to observability backends without requiring opt-in, potentially exposing service topology, roles, environment details, and account naming patterns. The issue is addressed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
CVE-2026-104871 is a path traversal vulnerability in Angular CLI's server-side rendering (SSR) tool affecting Windows deployments. It allows an unauthenticated attacker to retrieve sibling prerendered HTML pages under specific conditions involving relative request URLs with backslash parent-traversal segments. The issue is fixed in Angular CLI versions 20.3.36, 21.2.23, and 22.1.7.
Phproject versions from 1.1.6 up to but not including 1.8.7 have a missing object-level authorization vulnerability in the REST API issue endpoints. Authenticated API key holders can bypass confidentiality controls to read restricted issue data and post unauthorized comments. This vulnerability allows access to sensitive information such as owner and author email addresses.
This content discusses concerns about the potential threat posed by AI, particularly the claim that AI's ability to reverse engineer complex systems quickly could disrupt the global economy. The source is a TikTok video shared on Reddit's cybersecurity forum, but no specific technical vulnerability or exploit details are provided.
CVE-2026-103958 is a server-side request forgery (SSRF) vulnerability in AWS Loom versions before 1.7.0. It affects the tool server and remote agent connection handling, allowing an authenticated remote user to potentially obtain the application's container role credentials and read responses from arbitrary internal network locations. The vulnerability is fixed in version 1.7.0 and later.
CVE-2026-103957 is a server-side request forgery (SSRF) vulnerability in AWS Loom versions before 1.7.0. It affects the OAuth2 discovery handling, allowing an authenticated remote user to obtain another user's access token and make the application send requests to arbitrary internal network locations. The issue is fixed in version 1.7.0 and later.
Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role policies attached to managed agent roles, via any request to the application API in a deployment where no identity provider is configured.
To remediate this issue, users should upgrade to version 1.6.1 or later.
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. [...]
The NSA has announced an accelerated timeline for adopting post-quantum cryptography (PQC) measures to safeguard national security. Starting in 2027, all government software systems classified as NSS, including telecommunications, weapon systems, and intelligence platforms, will be required to support PQC. This acceleration is faster than previous NSA plans and ahead of timelines set by major tech companies like Cloudflare, Google, and Microsoft, which target 2029. The announcement suggests a heightened urgency possibly due to undisclosed advances in quantum computing threats.
The npm package '@smwebserver/static' version 99.9.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain known for malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No official patch or remediation information is provided.