118 matches found
nuclei-templates
Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...
CVE-2026-44613: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...
appsec-audit
appsec-audit — Claude Code skill: пентест задеплоенного продук...
CVE-2026-57111 Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
Permissive Cross-Origin Resource Sharing CORS in the REST API helix-rest, org.apache.helix.rest.server.filters.CORSFilter in Apache Helix through 2.0.0 on all platforms allows a remote attacker controlling a web page visited by an authorized user to read responses from and issue cross-origin...
CVE-2026-28201 SurrealDB Injection on Open Notebook
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...
CVE-2026-28201: Improper Input Validation
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...
Permissive Cross-domain Policy with Untrusted Domains
Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the CORSConfig.allowedoriginsregex, which uses a regex built from configured allowli...
CVE-2025-1102
A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests...
EUVD-2025-34775
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration...
EUVD-2018-0202
Malware in sbrugna...
EUVD-2020-8224
Malware in sbrugna...
EUVD-2021-1880
Malware in sbrugna...
EUVD-2019-0332
Malware in sbrugna...
EUVD-2021-26840
Malware in sbrugna...
EUVD-2023-1120
Malicious code in bioql PyPI...
EUVD-2023-2775
Malicious code in bioql PyPI...
EUVD-2021-28240
Malicious code in bioql PyPI...
EUVD-2025-7072
Malicious code in bioql PyPI...