10520 matches found
CVE-2026-56261
Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...
PYSEC-2026-3443
Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...
CVE-2026-56261
Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...
CVE-2026-56261 Crawl4AI - Server-Side Request Forgery via Webhook URLs
Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...
CVE-2026-56261 Crawl4AI - Server-Side Request Forgery via Webhook URLs
Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...
CVE-2026-56261
CVE-2026-56261 affects Crawl4AI prior to 0.8.7. The Docker API server endpoints /crawl/job and /llm/job accept webhook URLs without destination validation, allowing SSRF to private/internal IP ranges, Docker networks, or cloud metadata endpoints (e.g., 169.254.169.254). Potential impact is exposu...
EUVD-2026-42880
Crawl4AI before 0.8.7 contains a server-side request forgery SSRF vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, o...
[SECURITY] Fedora 43 Update: kind-0.31.0-4.fc43
Kubernetes IN Docker - local clusters for testing Kubernetes...
[SECURITY] Fedora 44 Update: kind-0.31.0-4.fc44
Kubernetes IN Docker - local clusters for testing Kubernetes...
openSUSE 16 Security Update : docker-compose (openSUSE-SU-2026:21247-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21247-1 advisory. This update for docker-compose fixes the following issues - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials...
EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2026-2525)
According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...
EulerOS 2.0 SP12 : docker-engine (EulerOS-SA-2026-2585)
According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to...
GHSA-XCGV-8MV7-V8C7 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, kots, net-kourier-fips, cerbos, kubeflow-katib, cilium-envoy-fips, prometheus, cloud-sql-proxy, grafana-alloy, grafana-operator-fips, kyverno, chainloop-cli, apko, commercial-grafana, beats-fips, langfuse, cilium-cli, knative-net-istio-fips,...
GHSA-XCGV-8MV7-V8C7 vulnerabilities
Vulnerabilities for packages: kube-fluentd-operator, pulumi-language-dotnet, kine, docker-cli-buildx, redka, opentofu, cerbos, snyk-cli, fuse-overlayfs-snapshotter, traefik, scorecard, telegraf, caddy, kubernetes-dashboard, prometheus-operator, timestamp-authority, nerdctl, rekor, grafana-alloy,...
GHSA-FF52-PH69-CF7X vulnerabilities
Vulnerabilities for packages: openbao-k8s, snyk-cli, kargo, vale, docker-machine-driver-linode, scorecard, haproxy-ingress, hubble, temporal-server, kube-bench, sriov-network-device-plugin, db-operator, crossplane-provider-aws-elasticache, gitlab-pages, nodetaint, envconsul, stakater-reloader,...
CVE-2026-59726 Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment
Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminalexecute, obtain...
CVE-2026-59726
Affected software: Ruflo, an agent meta-harness for Claude Code and Codex. Vulnerability: unauthenticated access to the MCP bridge endpoints POST /mcp and POST /mcp/:group in the default docker-compose deployment prior to version 3.16.3. Root cause / impact: unauthenticated network attacker could...
CVE-2026-59726 Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment
Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke tools/call to terminalexecute, obtain...
Exploit for Classic Buffer Overflow in Php
CVE-2019-11043 PHP-FPM Remote Code Execution CVE-2019-11...
Malicious code in antsrcsrctest (npm)
The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....