GHSA-76G3-C3X4-CRVX Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Problem Scrapy’s S3DownloadHandler sends signed S3 requests over plaintext HTTP by default. A normal request like s3://bucket/key is converted into http://bucket.s3.amazonaws.com/key unless request.meta"issecure" is explicitly set. The generated request is then signed with configured AWS...

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Problem Scrapy’s S3DownloadHandler sends signed S3 requests over plaintext HTTP by default. A normal request like s3://bucket/key is converted into http://bucket.s3.amazonaws.com/key unless request.meta"issecure" is explicitly set. The generated request is then signed with configured AWS...

CVE-2026-55221

Boruta is a standalone authorization server implementing OAuth 2.0 and OpenID Connect up to decentralized identity specifications. Prior to version 0.10.0 , Boruta logged sensitive credentials—including access tokens , refresh tokens , authorization codes , agent tokens , direct-post codes , ID t...

CVE-2026-55221 Boruta: OAuth credentials exposed in Boruta business logs

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...

EUVD-2026-70235

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker...

CVE-2026-49833 DSpace: Path Traversal possible in LDN message generation

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker...

CVE-2026-49833

DSpace (open source repository application) is affected by a path traversal vulnerability in the COAR Notify / LDN service (versions 8.0–8.3, 9.0–9.2, 10.0-rc1). The LDN class fails to restrict template file paths to the trusted $dspace.dir/config/ldn directory, allowing an attacker with administ...

CVE-2026-49833 DSpace: Path Traversal possible in LDN message generation

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, 9.0-rc1 to before 9.3, and 10-rc1 to before 10.0, a path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. The attacker...

Cross-site Scripting (XSS)

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the download process. An attacker can execute arbitrary JavaScript in the context of the application...

Cross-site Request Forgery (CSRF)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the netmount process. An attacker can force the application to mount an attacker-controlled FTP endpoin...

firmwalker

firmwalker A simple bash script for searching the extracted or mounted firmware file system. It will search through the extracted or mounted firmware file system for things of interest such as: etc/shadow and etc/passwd list out the etc/ssl directory search for SSL related files such as .pem, .cr...

SUSE CVE-2026-84199

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

CVE-2026-84674: Missing Authorization

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Fullhan FH8626V100 - Multiple Vulnerabilities

Exploit Title: Fullhan FH8626V100 - Multiple Vulnerabilities Date: 31-03-2026 Exploit Author: Amir Aliu Vendor Homepage: https://www.fullhan.com/ Software Link: N/A - OEM/whitelabel IP camera module, rebranded under numerous vendor/brand names Version: Firmware v201222.1007 Device Model AJL30PG08...

PT-2026-84652

Name of the Vulnerable Software and Affected Versions libcurl affected versions not specified Description A flaw exists where the software incorrectly reuses an HTTP connection setup for a specific hostname when using Negotiate authentication, specifically when the initial request is made with...

Missing permission checks in deployit-plugin allow enumerating credentials IDs

deployit-plugin 26.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

CVE-2026-84366

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...

CVE-2026-78608

Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server credentials that should be restricted to use...

GHSA-3F6P-5WW8-9RCR MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...