/
attack_type:ssrf × criticity:medium × limpar

Resultados

2 casos · pág. 1/1

yokai.hakaisecurity.io · medium

SSRF flaws CVE-2026-63642 and CVE-2026-63643 in MagicMirror² newsfeed and calendar modules, fixed in 2.37.0

The Yokai Research Team at Hakai Security disclosed two Server-Side Request Forgery (SSRF) vulnerabilities in MagicMirror², an open-source smart mirror platform: CVE-2026-63642 (blind SSRF in the newsfeed module) and CVE-2026-63643 (SSRF in the calendar module). Both let a client make the MagicMirror² server send HTTP requests to attacker…

CVE-2026-63642 CVE-2026-63643
hacktron.ai · medium

Hacktron CLI AI-assisted audit of JDBC drivers finds file read/write and RCE chain in Databricks, file read in Exasol; $85K in bounties

Researcher Harsh Jaiswal of Hacktron describes using the AI-assisted Hacktron CLI with a custom "JDBC driver pack" to audit decompiled JDBC drivers during a bug bounty event. The audit surfaced multiple vulnerabilities across vendor drivers, earning $85,000 in bounties. The headline finding is in the Databricks JDBC driver, where an attac…