VulncastBriefing archive

Daily Brief - 2026-07-04

· 5 vulnerabilities · 7 min listen

▶ Listen to this briefing

CVE-2026-10055

high · CVSS 8.5 · Eclipse Theia

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses, exposing internal administrative endpoints, cloud instance metadata services, and other resources that are intentionally outside the browser network boundary. The vulnerability affects deployments where the Theia service connection is reachable by untrusted users (for example, multi-tenant or publicly-reachable Theia deployments).

  • Server-Side Request Forgery
  • Information Disclosure
  • web application
  • rpc
  • http client

CVE-2026-58289

critical · CVSS 9 · Microsoft Edge

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  • Remote Code Execution
  • web browser
  • chromium

CVE-2026-58426

critical · CVSS 9.6 · Gitea

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

  • HMAC Validation Bypass
  • Cross-Repository Access
  • Privilege Escalation
  • git
  • web application
  • go

CVE-2026-8247

WatchGuard Fireware OS

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an unauthenticated attacker on the same local network segment to execute arbitrary code. This vulnerability affects Fireware OS 11.0 up to and including 11.12.4_Update1, 12.0 up to and including 12.12 and 2025.1 up to and including 2026.2.

  • Out-of-Bounds Write
  • Remote Code Execution
  • firewall
  • network appliance

CVE-2026-9547

curl libcurl

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.

  • Man-in-the-Middle
  • Improper Certificate Validation
  • c library
  • ssh
  • sftp