CVE-2026-79671

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-79671 Ech0 before 4.4.3 SSRF via DNS Resolution Bypass

Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function webhooksettingservice.go, which only validates literal IP addresses via net.ParseIP and fails to reject hostnames that DNS-resolve to private or internal IPs e.g., 169.254.169.254.nip.io. An...

CVE-2026-79671

Ech0 versions through 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the validateWebhookURL function (webhook_setting_service.go). The validation only rejects literal IP addresses via net.ParseIP() but fails to reject hostnames that DNS-resolve to private or internal addresse...

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

Malicious code in digitalexp-style-module-l9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c1b3e9059995d4d535c65fafd0105eea420510acb17ad9befbc99c18aa25df9 package.json declares both preinstall and postinstall as node beacon.js, so beacon.js runs automatically on every npm install. beacon.js reads...

CVE-2026-56708

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

CVE-2026-56708 Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

EUVD-2026-65206

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

CVE-2026-56708

The Grav API plugin before version 1.0.16 is affected by a server-side request forgery (SSRF) vulnerability in its webhook delivery mechanism. The root cause is a DNS rebinding attack that bypasses hostname validation: an attacker who controls the authoritative DNS for a configured webhook hostna...

EulerOS Virtualization 2.13.0 : dnsmasq (EulerOS-SA-2026-3210)

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A Denial of Service DoS vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via...

PT-2026-81459

Name of the Vulnerable Software and Affected Versions genieacs-mcp versions prior to 0.3.2 Description The Streamable HTTP transport in cmd/server/main.go creates an unauthenticated /mcp endpoint on the default address 127.0.0.1:8080 when the MCP AUTH TOKEN variable is unset. The server fails to...

PT-2026-81516

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw versions 0.0.0 through 0.0.25 Description NVIDIA NemoClaw for Linux contains a flaw in its inference server setup that allows a remote attacker to access the inference service without authentication. In affected configurations,...

CVE-2020-1350_HoneyPoC

Questo è un esercizio educativo. Usalo a tuo rischio. Exploit CVE-2020-1350 alias SIGRED Questa è una lezione sul perché non dovresti fidarti dei binari su Internet., la soluzione alternativa è genuina. Soluzione alternativa root@kitploit: reg add...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in FromStringDeserializer in src/main/java/com/fasterxml/jackson/databind/deser/std/FromStringDeserializer.java. An attacker can trigger outbound DNS lookups and blind...

Server-side Request Forgery (SSRF)

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the STDINETADDRESS branch in...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

EUVD-2026-65088

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...