CVE-2026-100279

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...

CVE-2015-1635_PoC

uso: python3 CVE-2015-1635PoC.py p. ej. python3 CVE-2015-1635PoC.py http://www.xxx.com...

EUVD-2026-90023

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...

CVE-2026-100279

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...

Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Overview On September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding CWE-177. An...

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

NPM: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop DoS vulnerability discovered by ? in WordPress Npm axios versions = 1.16.1, 1.20.0...

CVE-2026-102984

The Astro web framework, specifically the @astrojs/node adapter prior to version 11.1.3 , is vulnerable to a crash caused by a malformed port in the Host header . When the adapter builds a request URL, a malformed port creates an invalid URL; the subsequent recovery path reuses this host, trigger...

CVE-2026-103388

Versions of MISP prior to 2.5.48 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the Galaxy Cluster source field . The vulnerability occurs because the application renders the source field as a clickable hyperlink if it passes PHP's FILTER_VALIDATE_URL validation, which incorrectly ...

CVE-2026-103388 MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTERVALIDATEURL validation. Because FILTERVALIDATEURL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could...

CVE-2026-93903

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

EUVD-2026-89955

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

CVE-2026-93903

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

CVE-2026-93903

LiteSpeed Web Server (LSWS) versions prior to 6.3.7 build 1 are vulnerable to a flaw where the software mishandles internal redirect URL validation during specific "corner case" scenarios. This vulnerability could lead to significant impact as indicated by its CRITICAL severity rating (CVSS 4.0 s...

CVE-2025-20384

SPLUNK CVE-2025-20384 嗯，我只是读了我朋友发给我的东西，然后开始胡乱敲一些蹩脚的菜鸟 javascript 代码 日志注入/伪造/投毒/混淆类型 POC 请阅读这篇文章 OWASP Log Injection TL;DR 寻找静态文件，传递它并附加一些随机参数 所以，我执行 curl -k...

CVE-2026-102577

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2025-14564

The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...

CVE-2026-102577

A flaw in Moodle 's URL downloader allows an authenticated remote user to bypass host-blocking restrictions. The root cause is the incorrect handling of IPv4-mapped IPv6 addresses , which enables an attacker to provide a crafted URL that forces the server to make requests to restricted destinatio...

EUVD-2026-89716

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...

CVE-2026-102577 Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted...