Loading story…
A high-severity flaw tracked as CVE-2026-71272 affects usememos/memos versions up to and including 0.29.1, allowing attackers to bypass webhook SSRF protections through a DNS rebinding time-of-check/time-of-use weakness. The issue lies in safeDialContext() in internal/webhook/webhook.go, where the application validates IP addresses from an initial DNS lookup but later connects using the original hostname, triggering a second DNS resolution at dial time that an attacker-controlled DNS server can change.
The vulnerability is classified as CWE-367 and carries a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating low attack complexity and high confidentiality impact. The affected webhook component was designed to block connections to private and reserved IP ranges and supports signed webhook delivery with HMAC-SHA256, but the hostname re-resolution behavior undermines those safeguards when an attacker can control DNS responses for the webhook target.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-71272 was newly received for usememos/memos, affecting versions up to and including 0.29.1. The issue is a TOCTOU DNS rebinding weakness in safeDialContext() that can bypass SSRF protections by validating one DNS result and connecting using a later hostname resolution.
The usememos/memos repository contains internal/webhook/webhook.go implementing webhook dispatch with a custom safeDialContext function intended to block reserved or private IP addresses and mitigate SSRF and DNS rebinding risks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-64849**, a critical unauthenticated server-side request forgery flaw in MLflow’s webhook delivery logic, to steal credentials and sensitive data from exposed tracking server deployments. The vulnerability affects MLflow versions prior to **`3.15.0`** and abuses the default-enabled model-registry webhooks API, allowing crafted webhook requests to reach internal services and cloud metadata endpoints. Researchers reported exploitation within hours of the CVE being assigned, with attempts to extract secrets from addresses including **`127.0.0.1`** and **`169.254.169.254`**. The flaw stems from MLflow validating a webhook URL and then re-resolving or following redirect targets during delivery, enabling DNS rebinding or redirect-based access to non-public destinations. Successful exploitation can expose highly privileged credentials, including AWS IAM role credentials tied to EC2 instances or Kubernetes nodes, and may provide access to internal databases, configurations, and administrative tools. The vulnerability carries a **CVSS 9.3** rating, and MLflow **`3.15.0`** addresses it by tightening destination validation and blocking non-global IP addresses; defenders are being urged to patch immediately and investigate whether secrets or cloud credentials were exposed.
Aug 24, 2026
A critical unauthenticated server-side request forgery flaw, tracked as **`CVE-2026-78003`**, was disclosed in the **Mailgun for WordPress** plugin and affects versions through **`2.2.0`**. The bug stems from insufficient validation in the plugin's `add_list()` function, allowing attacker-controlled array keys to trigger path traversal and redirect authenticated Mailgun API requests to attacker-controlled endpoints. The issue carries a **CVSS 3.1 score of 9.8** and affects a plugin reported to have more than **80,000 active installations**. Attackers can exploit the flaw to create malicious inbound email-forwarding routes, intercept password reset messages, and ultimately seize **WordPress administrator** accounts. A fix is available in **`2.2.1`**, and defenders were urged to update immediately, rotate Mailgun API keys, and inspect Mailgun routes and mailing-list settings for unauthorized changes. Public detection coverage is also emerging, with a **Nuclei** template for `CVE-2026-78003` submitted to the ProjectDiscovery templates repository.
Aug 25, 2026
A high-severity vulnerability tracked as **CVE-2026-49948** affects self-hosted **Mem0** deployments through version `0.2.8`, allowing any authenticated user to modify global settings through the `POST /configure` endpoint. The flaw stems from missing authorization checks: the server accepts a valid JWT or distributed `X-API-Key` but does not verify the caller’s role before permitting changes to the instance-wide LLM provider and embedder configuration. An attacker with low privileges can use the weakness to redirect all LLM and embedding traffic for the instance to an attacker-controlled server, exposing sensitive data and enabling broad integrity compromise across all users and API keys. The malicious configuration is stored in PostgreSQL and survives restarts, making the change persistent until corrected. The issue is classified as **CWE-862** and was fixed in commit `ae7f406`.
Jun 29, 2026