Malicious code in chai-jsonss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67 On import, index.js invokes postCallers which resolves a base64-encoded URL stored in lib/const.js decoding to https://1uznbx.s.gy/7xdQmt, GETs the...

CVE-2026-72577

creationtimestamp| type| source ---|---|--- 2026-08-10 11:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspzcgmhzz2u...

CVE-2026-72575

creationtimestamp| type| source ---|---|--- 2026-08-10 11:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspzcf56622b...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-40920

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

EEF-CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

Summary URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private...

Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup

SummaryA user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied ...

EUVD-2026-55215

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72581

CVE-2026-72581 describes a server-side request forgery in duhow/xiaoai-patch introduced by commit fb07049. The /auth endpoint in api/main.py uses a user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling an attacker to cause the X...

EUVD-2026-55232

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

CVE-2026-71392

creationtimestamp| type| source ---|---|--- 2026-08-10 10:39:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/enijmvsyiaud2 2026-08-10 12:45:15+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-71391...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...

CVE-2026-44102

creationtimestamp| type| source ---|---|--- 2026-08-10 10:30:06+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3mspvfaxfz72c...

CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...