39558 matches found
EUVD-2026-46147
A vulnerability was found in trinodb trino 481. Affected is an unknown function of the file core/trino-main/src/main/java/io/trino/server/ExternalUriInfo.java of the component OAuth2/OIDC. Performing a manipulation of the argument redirecturi results in open redirect. It is possible to initiate t...
EUVD-2024-55690
The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub424CE0 function of the file /goform/setMacFilterCfg...
Malicious code in faust-cont (npm)
The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...
PT-2026-63308
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated low-privilege user can perform a server-side request forgery SSRF during repository migration. The issue occurs because the validation logic in services/migrations/migrate.go...
CVE-2026-16403: User Interface (UI) Misrepresentation of Critical Information
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...
PT-2026-61915
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A spoofing issue exists within the Address Bar component, which could allow an attacker to deceive users by manipulating the displayed address. Recommendations Update...
GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...
CVE-2026-47255
AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Impact CookieJar does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored cookie's Domain attribute is an IPv4 literal Domain=192.168.0.1, a bracketed IPv6 literal Domain=::1, or a bare numeric value that denotes an IPv4 address Domain=1, which is 0.0.0.1,...
GHSA-G446-98W2-8P5W Guzzle: Cookie Disclosure and Injection via IP-Address Domains
Impact CookieJar does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored cookie's Domain attribute is an IPv4 literal Domain=192.168.0.1, a bracketed IPv6 literal Domain=::1, or a bare numeric value that denotes an IPv4 address Domain=1, which is 0.0.0.1,...
CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...
CVE-2026-64626
The CVE affects AVideo encoder download-by-URL flow from commit 0dbadbca to latest master, where an unpinned retry fallback bypasses DNS pinning validation, enabling an authenticated attacker to supply a downloadURL that redirects to an internal address and have the unpinned retry follow the redi...
CVE-2026-63770
creationtimestamp| type| source ---|---|--- 2026-07-20 21:49:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4bkfaom222...
GHSA-J5H6-VQC3-PHQH Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0. While 127.0.0.1 and other internal addresses are denied, 0.0.0.0 is not added to the blocklist. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user...
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0. While 127.0.0.1 and other internal addresses are denied, 0.0.0.0 is not added to the blocklist. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user...
GHSA-X756-G4X3-C64M Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...
CVE-2026-56623
creationtimestamp| type| source ---|---|--- 2026-07-20 21:00:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr46seddce2x 2026-07-20 21:56:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4bwrjqod2q...
CVE-2026-41521
creationtimestamp| type| source ---|---|--- 2026-07-20 20:54:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr46icr4di2a 2026-07-23 09:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrciecdpch2l...