Malicious Package

Overview twork-data-services-aggregator-sme-task-info is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview twork-data-services-proxy-invest-symbols-list is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview twork-data-services-counterfree is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview twork-data-services-customer-api-v2-customer-vip-status is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between...

Malicious Package

Overview twork-data-services-proxy-prime-api-v1-account-overdraft-info is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection...

Server-side Request Forgery (SSRF)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validatenetworkurl DNS resolution path in nltk/pathsec.py. An attacker can make urlopen reach restrict...

FreeBSD : tailscale -- Insufficient validation of 4via6 subnet router destinations (4bf4495e-9d4e-11f1-a129-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4bf4495e-9d4e-11f1-a129-901b0e9408dc advisory. Tailscale team reports: Insufficient validation of 4via6 subnet router destinations permitted access to...

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

CVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-77769

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

MLflow < 3.15.0 SSRF (CVE-2026-64849)

The version of MLflow installed on the remote host is prior to 3.15.0. It is, therefore, affected by a server-side request forgery vulnerability: - The unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl only for the original URL while the webhook delivery...

CVE-2026-16323: Execution After Redirect (EAR)

Execution after redirect EAR vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel allows Authentication Bypass. This issue affects ArchitectPanel Web Admin Panel: through 28072026...

CVE-2026-77775: Server-Side Request Forgery (SSRF)

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...

Oracle WebCenter Portal (August 2026 CSPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Portal installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Composer. Supported versio...

CVE-2026-69400 Azure Logic Apps Elevation of Privilege Vulnerability

...

EUVD-2026-62957

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for...

KLA91236 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability...

CVE-2026-76392

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores credentials for...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 5 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update

Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 5 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...