August 17, 2026
- Unauthenticated RCE in CircleCI's MCP server (GHSA-xv5j-cwgj-22r4). The Host/Origin allowlist can be bypassed by any non-browser client, giving unauthenticated code execution — another cautionary MCP deployment story (Remedio). · Vulnerabilities & Exploits
in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover