News
Daily and weekly security vulnerability digests and advisories.
· 6 min read
fast-uri Host Confusion, an undici Crash and Two Angular SSR Fixes
Two fast-uri bugs let URLs pass host checks but reach localhost, a bad WebSocket frame crashes undici, and Angular SSR fixes a DoS and an XSS.
· 5 min read
Account Takeover by Email Match: Vendure, Sync-in, SSRF Guard Crash
Vendure linked external logins to existing accounts by unverified email, Sync-in's token endpoint skipped 2FA, request-filtering-agent crashes on private IPs.
· 6 min read
Localhost Isn't Private: DBHub, Cline and Rsdoctor Advisories
DBHub, Cline and Rsdoctor ran local servers any website could reach: SQL execution, agent takeover, source leaks. Plus AWS language server and Elysia fixes.
· 6 min read
A Missing await, a Default Allow: This Week's Fail-Open Auth Bugs
Unleash, deepstream and 9router each shipped an auth check that silently let requests through. Plus an MCP path traversal and a CVSS 10 SunEditor XSS.
Stay ahead of new threats
Follow GuardVibe in your feed reader. No account, no email.