The SSE transport mode (SSE=true) exposes all MCP tools without any authentication. The uploadmarkdown tool reads arbitrary files from the server's local filesystem via an unsanitized filepath parameter and uploads them to a GitLab project.…

@zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be…

Server-Side Request Forgery via X-GitLab-API-URL Header Allows Credential Theft Affected - Repository: zereight/gitlab-mcp - Affected versions: All versions through commit 74a8c83 - Patched versions: None at time of report Severity High. CVSS v3.1 8.5…

The DigestAuth server middleware's stale-nonce cleanup uses an inverted comparison: it removes fresh nonces and stops at the first stale one. Because a new nonce is created for every unauthenticated challenge, an attacker can drive the nonce map to grow…

The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were…

Mockoon's admin API (commons-server/src/libs/server/admin-api.ts) is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime (commons-server, CLI, serverless), serves… Developers running Mockoon's shipped runtimes are exposed because its admin API is enabled by default.

There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge (Go 1.24), a client-initiated Upgrade: h2c request header and its…

Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS… Traefik HTTP/3 users are exposed to backend NTLM and Negotiate connection reuse.

Unbounded Remote Media Fetch and Video Frame Expansion DoS Summary The POST /v1/chat/completions endpoint in mistral.rs fetches attacker-supplied media URLs (image, audio, video) into server memory with no byte limit, and extracts every frame of a supplied… Servers exposing POST /v1/chat/completions to attacker-supplied media URLs are exposed to denial of service.

Two stages of expression code generation built source text by calling the global JSON.stringify at generation time: the compiler when printing synthetic string literals, and the isolate bridge when interpolating a timezone value into its…

A discrepancy between WHATWG URL parsing and Angular SSR's URL resolution allows attackers to bypass same-origin checks and cause Server-Side Request Forgery (SSRF), potentially leaking sensitive server-side credentials. Technical Description When… Applications using @angular/platform-server are exposed to high-severity SSRF and server-side credential disclosure.

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join() when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read… Unauthenticated attackers who can reach @openhop/server can exploit its flow ID file operations.

Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open… Repositories where attackers have ordinary write access are exposed to arbitrary shell command execution as the Gitea OS user.

nltk.corpus.reader.api.CorpusReader.open() can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does… Developers with symlinks inside an NLTK corpus root expose arbitrary local files through CorpusReader.

Several XML parsing sites in NLTK still used xml.etree.ElementTree directly, which honours declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory (each nesting level multiplies by… NLTK users are exposed when its XML parsers process crafted documents.

@typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server…

The OpenChoreo control-plane cluster-gateway exposes internal management APIs (/api/proxy/, /api/exec/, /api/wirelogs/) that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its…

CVE: This vulnerability corresponds to CVE-2026-72794. Summary /api/system/getConf returns Conf.CookieKey, the key used to sign the server's session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the…

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 43563356b98c6b993085554da82e77370160a31c. Users should upgrade to 0.8.64 or…

Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or…

CVE: This vulnerability corresponds to CVE-2026-68584. Summary SiYuan's publish mode defines a "protected" access level: a document that is publicly listed but requires a password to read (per the product's own UI help text, protected = "Publicly visible,…

CVE: This vulnerability corresponds to CVE-2026-69083. Summary The /api/search/fullTextSearchAssetContent endpoint exposes two SQL flaws on the asset-content database, both reachable by the publish RoleReader token and by the anonymous account when…

Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL ( /users/... ) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is…

Sep 16 , 21:15 UTC In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary. Sep 14 , 22:10 UTC Scheduled - We will be performing a database migration in the EU region that will pause span ingestion and disable…

Sep 16 , 14:55 UTC Investigating - We are investigating a delay in pipeline data becoming available. Pipelines are still running, but data about them may be delayed in the UI or API.

Sep 16 , 09:38 UTC Monitoring - Error rates have returned to normal, and the service is operating as expected. The team continues to investigate the underlying cause of the latency and spike in 503 errors. Sep 16 , 09:24 UTC Investigating - We are…

Sep 16 , 11:45 UTC Monitoring - The degradation affecting Copilot AI Model Providers has been mitigated. We are monitoring to ensure stability. Sep 16 , 10:58 UTC Update - Copilot AI Model Providers is experiencing degraded performance. We are continuing…

Sep 15 , 16:13 UTC Investigating - We are investigating delays affecting npm package publishing. Some newly published package versions may take longer than expected to become available.

Sep 15 , 15:14 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 15 , 02:01 UTC Identified - We are investigating an issue where messages published to some queues are not being delivered to their consumers, resulting…

Sep 15 , 00:03 UTC Identified - Some third party models as well as https://replicate.com/qwen/qwen-edit-multiangle are affected and are unable to scale out. Please use alternate models while we work with providers to publish fixed versions. Sep 14 ,…

Sep 14 , 19:01 UTC Monitoring - The degradation has been mitigated. We are monitoring to ensure stability. Sep 14 , 18:40 UTC Investigating - We are investigating reports of impacted performance for some GitHub services.

Sep 13 , 00:18 UTC Identified - We've identified and fixed the cause of the metrics delay. The queue is being processed and delayed metrics will be viewable when complete. Sep 12 , 23:21 UTC Investigating - We are investigating metrics delays in the console. Elastic Cloud users in GCP us-east4 should wait for delayed console metrics to become viewable as the queue finishes processing.

Sep 11 , 23:41 UTC Update - We continue to monitor progress and are slowly updating each region. Thank you for your patience on this issue. Sep 7 , 09:49 UTC Update - Testing results have been positive. Following some additional checks today, we plan to…

Sep 11 , 23:15 UTC Identified - The issue has been identified and a fix is being implemented. Sep 11 , 21:55 UTC Investigating - Cloudflare is investigating issues with Cloudflare Tunnel. More updates to follow shortly. Cloudflare Tunnel users may experience service issues while Cloudflare implements a fix.

Sep 11 , 02:01 UTC Monitoring - Atlas is seeing elevated errors rates of certificate issuance due to a Let's Encrypt outage (https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/6aa35c1d892d7304f2747e01). Free and flex tier cluster…

Sep 11 , 00:04 UTC Update - Current status: Our third-party cloud platform provider has informed us that they expect to be able to provide additional capacity allocation by mid-October. In the meantime, we are working to preserve compute resources…

Sep 10 , 15:54 UTC Identified - A Windows update released September 8 has left Claude Cowork on Windows unable to run local commands, because its workspace can no longer reach your computer's drive. For most users, chat and file reading and editing still… Windows users running Claude Cowork cannot run local commands after the September 8 update, but most can still chat and edit files.

Sep 10 , 01:30 UTC Identified - We have identified and are in the process of fixing+mitigating a bug in our permissions management UI that is prevents users with the Organisation Owner role and Cloud Console, Elasticsearch, and Kibana access from accessing…

Sep 9 , 20:44 UTC Identified - We've identified a bug in Fleet Server 9.5.3 (also present in 9.4.6) that can cause Elastic Agents to crash-loop and go offline when Fleet pushes a configuration update, including enrollment, a policy change, or a routine…

Sep 8 , 01:32 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 8 , 00:35 UTC Investigating - Cloudflare customers may experience an issue when invited to a new account. An error message is displayed, "Invaild… Cloudflare customers invited to a new account may see an error while Cloudflare monitors an implemented fix.

Sep 7 , 16:46 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 7 , 16:11 UTC Identified - The issue has been identified and a fix is being implemented. Sep 7 , 15:52 UTC Investigating - We are continuing to…

Sep 6 , 16:36 UTC Investigating - Customers may experience intermittent connectivity issues when accessing services through our Canberra (CBR01) data center. Our team is actively working to restore normal service.

2.1.1 September 16, 2026 SECURITY: core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability GHSA-8wv5-x4w7-5gww . core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355. core: Update…

SCIM user responses from GitHub now include the standard profileUrl attribute defined by RFC 7643, containing the absolute URL of the GitHub account linked to the external identity. Previously, matching… The post SCIM user responses now include a…

compiler Commit Description wrap @for collection expression before appe

Hobby projects now retain fewer deployments past the 30-day retention window. Hobby teams get 10GB of Deployment Storage . Every deployment you keep uses some of it, and going over the limit can block you from deploying until you free some up. Deployment…

What's Changed Add node:stream web-interop suite by @jasnell in <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5436833689" data-permission-text="Title is private"…

Release Notes for v44.4.1 Fixes Fixed default protocol client APIs falsely returning true on Windows. #53959 (Also in 43 , <a href="https://github.com/electron/electron/pull/53958" data-hovercard-type="pullrequest" data-hovercard-url="/ele

Is Agentic reports now let you view your checks through one of four site types: Docs & content, Business, App, or Commerce. For example, the Commerce view highlights payment and checkout standards like x402, UCP, and ACP, while the App view highlights API…

Release Notes for v42.11.4 Fixes Fixed a renderer crash when an iframe was removed right after loading with nodeIntegrationInSubFrames enabled and sandbox disabled, e.g. on pages that embed Meta Pixel. #53886 (Also in 43 , <a h

It was discovered that polkit incorrectly handled cookie input. A local attacker could possibly use this issue to cause polkit to crash, resulting in a denial of service, or execute arbitrary code.

pnpm 12.4.2 includes security fixes for executable shims and GitHub Actions links, more reliable installs, faster peer dependency checks in workspaces, and Python lockfiles that work across compatible targets. Patch Changes Security Dependency executables…

Images and binaries here: https://github.com/open-telemetry/opentelemetry-collector-releases/releases/tag/ End User Changelog 🛑 Breaking changes 🛑 pkg/pprofile : Remove deprecated AggregationTemporality, Duration, SetDuration (<a class="issue-link…

2.0.1 Released September 14, 2026 Features Install agent skills (AgentSkills-format SKILL.md directories) from installed packages and the project's own skill-paths when packages are installed, gated on the new aiprovider flag. ( #14556 ) Support native…

llama.cpp 0.4.1 adds Maple 20B-A1B, Tencent Hy 4, and Spark2.5 support, improves JSON schema handling, chat parsing, logging, and server child-process management, and updates ggml to v0.24.0. API changes Changed llamasamplerchainn() to return…

GitHub Copilot auto model selection now offers three tiers: efficiency, balance, and intelligence. Choose the tier that reflects how you want auto to weigh cost, quality, and response time for… The post Configure cost and quality in Copilot auto model…

Perplexity uses Astra to write communications, change software, and monitor production systems, and checks in much less frequently than with earlier models.

Soft-deprecating re.match() Python has a concept of soft deprecation , where APIs are marked as "should no longer be used to write new code" without any promise/threat to remove them in the future. Python 3.15 release manager Hugo van Kemenade describes…

pnpm 12.4.1 fixes installs that failed on filesystems refusing hard links or clones, on Android, and under nodeLinker: hoisted . Repeat installs are faster. Patch Changes Installing packages pnpm install no longer fails with Operation not permitted when…

FastAPI frontends and static files, served with app.frontend() or StaticFiles , are now promoted to the Vercel CDN at build time. Requests for those paths are served directly from the CDN, without invoking your Vercel Function. FastAPI evaluates routes in… Developers using FastAPI frontends or static files now serve those paths from the Vercel CDN without invoking a Vercel Function.

Release Notes Released on 2026-09-09. The executables in our macOS and Windows release archives and uv and uvbuild wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables… Users of the macOS and Windows archives or uv and uvbuild wheels receive code-signed executables.

Tool: Video compressor I recorded a short demo video of my Equal Earth animation on my phone and wanted to publish an optimized version of that video (using FFMPEG) on my blog, so I had Claude Fable 5.1 in Claude Code for web build me this tool using the… Run the tool to optimize a recorded video for blog publication.

[SECURITY] Bump github.com/klauspost/compress to v1.18.7 (GO-2026-5841) and golang.org/x/crypto to v0.55.0 (GO-2026-6303). [BUGFIX] Docker SD: Fix panic in Docker Swarm service discovery when a service runs as a plugin or network-attachment. <a…

Minor Changes Catalogs can now resolve workspace dependencies through the workspace: protocol. pnpm remove and pnpm update now accept --trust-lockfile , --no-trust-lockfile , --trust-policy , --trust-policy-exclude , and --trust-policy-ignore-after . pnpm…

Research acceleration: The view inside OpenAI Apparently today is RSI day at OpenAI, for Recursive Self-Improvement - I think it's their new AGI. Both this piece and the new essay An Alien Mind (by Chief Scientist Jakub Pachocki) talk about it, and this…

TIL: Using Blender with coding agents on macOS I've been having fun with Blender in ChatGPT Codex on my Mac recently. Getting it to work with coding agents is really easy: install the full Mac application from blender.org and run a prompt like this: Use…

Release Notes Released on 2026-09-04. Enhancements Attempt to revoke short-lived PyPI trusted-publishing tokens after uv publish completes, including when publishing fails ( #21423 ) Preview features Omit exclude-newer-package settings for packages outside…

Welcome to the v2.3.5 release of containerd! The fifth patch release for containerd 2.3 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-53495 GHSA-rp3h-jf77-q9p4 Highlights Image Distribution Apply harde

Status: Resolved Our Engineering team has resolved the issue. These systems should now be operating normally. If you continue to experience any problems, please open a ticket with our support team. Affected components HCP Vault Radar (Operational)

Sep 16 , 18:35 UTC Resolved - Customers may have observed elevated rates of HTTP 522 error responses from our St. Louis (STL) facility between approximately 16:35 and 16:55 UTC today, 2026-09-16.

Status: Monitoring We have applied the mitigation and are monitoring the recovery. Affected components Images (Partial outage)

Sep 15 , 18:19 UTC Resolved - This incident has been resolved. Sep 15 , 18:18 UTC Update - Stable Sep 15 , 17:20 UTC Identified - The issue has been identified and a fix is being implemented. Sep 15

Sep 15 , 11:14 UTC Resolved - A fix has been deployed for Claude Mythos 5.1 and Claude Fable 5.1 and we are monitoring to ensure it has resolved the issue. Sep 15 , 10:50 UTC Monitoring - A fix has been deployed for Claude Mythos 5.1 and Claude Fable 5.1…

Status: Monitoring We have applied additional mitigations for Work Mode. We are monitoring to confirm that workspace tools and files are functioning normally for ChatGPT Plus users. Affected components ChatGPT Work (Operational)

Status: Monitoring We have applied the mitigation and are monitoring the recovery. Affected components Conversations (Degraded performance)

Sep 13 , 10:44 UTC Resolved - This incident has been resolved. Thank you for your patience and understanding as we addressed this issue. A detailed root cause analysis will be shared as soon as it is available. Sep 13 , 10:28 UTC Update - Pull Requests is…

Status: Resolved All impacted services have now fully recovered. Affected components Codex in ChatGPT Desktop (Operational)

Sep 12 , 10:42 UTC Resolved - This incident has been resolved. Sep 12 , 10:10 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 12 , 08:11 UTC Identified - The issue has been identified and a fix is being implemented.…

Sep 12 , 03:34 UTC Resolved - This incident has been resolved. Sep 12 , 02:25 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 9 , 19:18 UTC Identified - The issue has been identified and a fix is being implemented.…

Turn the user's description or uploaded reference into a finished, editable Blender card and an interactive Three.js page. Preserve the requested subject, style, typography and destination. This skill contains code and text only; generated artwork belongs…

Sep 11 , 22:03 UTC Resolved - This incident has been resolved. Sep 11 , 19:35 UTC Investigating - Cloudflare is investigating issues with Network Performance in Taiwan datacenter (TPE) We are working to analyze and mitigate this problem.…

Sep 11 , 19:06 UTC Resolved - This incident has been resolved. Sep 11 , 06:19 UTC Update - We have rolled out a fix across all regions and are continuing to monitor over the next few hours. Due to this incident, impacted users who's project were compute…

Status: Resolved All impacted services have now fully recovered. Affected components Chat Completions (Operational) Responses (Operational) Developers using Chat Completions or Responses are no longer affected.

Sep 11 , 06:22 UTC Resolved - An issue prevented Workers VPC from correctly resolving hostname routes for a small subset of accounts between 06:22 and 09:38 UTC on Friday, September 11th, 2026. This problem has been fully resolved, and all services… Workers VPC users in a small subset of accounts experienced hostname route resolution failures, but Cloudflare resolved the issue.

Sep 10 , 20:26 UTC Resolved - This incident has been resolved. Sep 10 , 20:25 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 10 , 20:25 UTC Identified - A small number of customers may see errors or be unable to loa Only a small number of CircleCI customers may have seen pipeline loading errors; the incident is resolved.

Status: Monitoring We have applied the mitigation and are monitoring the recovery. Affected components Conversations (Degraded performance)

Status: Identified We are currently updating documentation and package verification guidance following an ongoing GPG key rotation for all HashiCorp Linux packages. The fingerprint currently displayed on our site is outdated and may not match the active…

Status: Monitoring We have applied the mitigation and are monitoring the recovery. Affected components File uploads (Degraded performance) GPTs (Degraded performance) Developers using OpenAI file uploads or GPTs should monitor the recovery.

Status: Investigating We’re investigating elevated errors affecting image generation in ChatGPT and the Images API. Some requests may fail. We’ll share another update as we learn more. Affected components Images (Degraded performance) Image Generation… Developers using the Images API may see some image-generation requests fail.

Sep 7 , 19:14 UTC Resolved - This incident has been resolved. Sep 7 , 15:11 UTC Monitoring - A fix has been implemented and we are monitoring the results. Customers still experiencing the issue may attempt to close all their Browser…

Sep 7 , 13:52 UTC Resolved - A fix was deployed for this issue and the impact is over for any new connections on Realtime TURN service. Existing connection will continue to use TCP until the customers clients end and restart their… New TURN connections are unaffected; existing connections continue using TCP until clients end and restart them.

Sep 6 , 21:50 UTC Resolved - This incident has been resolved. Sep 6 , 17:06 UTC Investigating - We are investigating reports of delays in the provisioning of newly purchased domains. Our engineering team is currently working to resolve these delays…

Sep 5 , 00:42 UTC Resolved - This incident has been resolved. Sep 5 , 00:13 UTC Monitoring - A fix has been implemented and we are monitoring the results. Sep 4 , 21:27 UTC Identified - The cause of this issue has been identified and a fix is being…