119620 matches found
CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
CVE-2026-82247
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
CVE-2026-82247
CVE-2026-82247 affects the gix-url crate (≤ 0.32.0) within the gitoxide Rust library. Its hand-rolled URL parser fails to treat ? or # as authority terminators per RFC 3986 , causing gix-transport 's HTTP redirect identity guard (can_reuse_identity) to compare the wrong host and fail open . An at...
CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
EUVD-2026-67699
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...
CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...
EUVD-2026-67698
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...
CVE-2026-82246
Budibase Server before 3.41.3 is affected by a server-side request forgery (SSRF) vulnerability in the query import endpoint . The root cause is the failure to validate user-supplied URLs before fetching content, allowing authenticated attackers to submit arbitrary URLs and retrieve responses fro...
CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...
SUSE CVE-2024-29180
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...
CVE-2026-78615
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
SUSE CVE-2026-55677
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...
CVE-2026-54330
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...
CVE-2026-50979
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...
CVE-2026-37237
vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...
CVE-2026-37710
The software Omeka S (version 4.2.0 ) is vulnerable to a Cross-Site Scripting (XSS) flaw within the site navigation custom URL process. An attacker can inject malicious code that is executed in the context of a user's browser because the application fails to properly validate and escape input bef...