123092 matches found
Dotnetnuke < 10.3.3 Server-Side request forgery in journal module (GHSA-hmwm-c2hx-wmxh)
According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - A server-side request forgery SSRF vulnerability in the Journal module could allow an authenticated user to cause the server to...
GHSA-VX2M-JPXR-XV7W Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...
Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint
Summary Cloudreve's file-listing responses hand the client a contexthint UUID that is meant to speed up follow-up operations. When that hint is replayed on the file/url and file/thumb routes, DBFS caches a shareNavigatorState containing the already-loaded share root and share row. On a later...
CVE-2026-76838
Hi.Events (an open-source event management platform) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its webhook handling. The NoInternalUrlRule validates a webhook destination using gethostbyname() only at registration time , but the WebhookDispatchService never revalidates ...
MAL-2026-14432 Malicious code in kelly-stake-sizing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...
Malicious code in poly-price-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219fd8bc805a260cc62a5a3f9d524f9bb69ba2f8c5ae65e9a13e64514fdd0cf6 [email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices-uploadConfigIfExists, which...
gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL
A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...
awx: webhook status callback SSRF leaks the Git PAT
A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...
gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL
A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...
CVE-2026-71366 Awx: notification backends allow ssrf and credential leakage
A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...
EUVD-2026-64923
A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...
Improper Handling of URL Encoding (Hex Encoding)
Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding through the parseWithStatus, normalizeStringWithStatus, normalizeComparableURI, and resolve paths in index.js. An attacker can steer a URL...
CVE-2026-39915
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...
CVE-2026-78385
RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and passed to WeasyPrint for PDF rendering. Prior to the fix, WeasyPrint used its default URL fetcher, allowing resource references contained i...
CVE-2026-76842
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...
CVE-2026-17033
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
CVE-2026-17033 CVE-2026-17033 CVE Record
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
CVE-2026-17033
Grafana OSS is vulnerable to a stored cross-site scripting (XSS) flaw in how it handles external Alertmanager alerts. An authenticated attacker with Editor access or alert.instances.external:write can submit an alert containing a crafted generatorURL field. Grafana renders this value directly as ...
CVE-2026-17033 CVE-2026-17033 CVE Record
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...
EUVD-2026-64887
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders...