CVE-2023-27163

CVE-2023-27163 PoC CVE-2023-27163, SSRF, request-baskets hasta v1.2.1 Ejemplo de uso myscript.sh -i 10.10.11.111 -f 'localhost:80' -t 10.10.14.27 -i ip de servidor victima -f ip o dirección a donde dirigir las conexiones producidas por el SSRF -t en esta opción va su ip local o la ip atacante, pa...

EUVD-2026-87092

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2023-41080

vulnerable: http://localhost:8081//secret.html;@example.com Redirección a un sitio web arbitrario en este caso, https://example.com. parcheado: http://localhost:8082//secret.html;@example.com ref: https://github.com/advisories/GHSA-q3mw-pvr8-9ggc...

CVE-2026-93987 rclone serve docker Path Traversal via Volume Name

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...

EulerOS Virtualization 2.11.1 : wget (EulerOS-SA-2026-3481)

According to the versions of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are...

EulerOS Virtualization 2.11.0 : wget (EulerOS-SA-2026-3569)

According to the versions of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are...

[SECURITY] [DSA 6467-1] freecad security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6467-1 [email protected] https://www.debian.org/security/ Aron Xu August 26, 2026 https://www.debian.org/security/faq -...

PT-2026-79052

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An authenticated user, regardless of whether they possess an administrative role, can trigger the InLong Manager server to initiate outbound HTTP requests or TCP connections to arbitrary...

CVE-2026-47686: Protection Mechanism Failure

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process...

CVE-2026-47698: Improper Control of Dynamically-Managed Code Resources

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

CVE-2026-73217: Protection Mechanism Failure

Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...

CVE-2026-72867: Improper Input Validation

Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...

CVE-2026-17597

Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) in the email configuration verification feature. A user with nexus:settings:update can submit arbitrary host/port values to the email test/verification endpoint, causing the server to initiate outbound connections to internal or res...

SUSE CVE-2026-3112

Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to validate Advanced Logging file target paths which allows system administrators to read arbitrary host files via malicious AdvancedLoggingJSON configuration in support packet generation. Mattermost...

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

EUVD-2026-51066

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

PT-2026-66438

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-17552

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...

CVE-2026-17552 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call. When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash '/'. When the rewrite base does...