138 matches found
EUVD-2026-75674
A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...
CVE-2026-89049
AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms is affected by a server-side request forgery (SSRF) flaw in the Session Manager port forwarding to remote hosts functionality. The root cause is improper validation of equivalent address representations , allowing an authent...
PT-2026-89562
A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...
CVE-2023-43208
CVE-2023-43208 — Mirth Connect Pre-Auth RCE Pre-authenticated Remote Code Execution in NextGen Healthcare Mirth Connect CVSS 9.8 Critical — Patch bypass of CVE-2023-37679 Overview Mirth Connect uses the Java XStream library to deserialize XML payloads on the /api/users endpoint without...
CVE-2026-78678
A flaw was found in GitPython. An incomplete denylist in the unsafegitrevisionoptions guard omits --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the Repo.blame function. This can lead to information disclosure, as attackers can supply revisi...
CVE-2026-79696
Google Cloud Agent Development Kit (ADK) for Python (versions 2.0.0 through 2.6.0) contains a code injection vulnerability in the adk web component caused by an incomplete standard library denylist . In environments where pytest is installed—on Python (OSS), Cloud Run, and GKE—an unauthenticated ...
EUVD-2026-65224
GitPython: Incomplete unsafegitrevisionoptions denylist omits --contents/-S, enabling arbitrary file read via Repo.blame...
gitpython: GitPython: Remote Code Execution via malicious Git template
A flaw was found in GitPython. An incomplete denylist in the unsafegitcloneoptions function fails to restrict the --template option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations...
Linux Distros Unpatched Vulnerability : CVE-2026-84394
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but do...
CVE-2026-84218
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
CVE-2026-84218 Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
EUVD-2026-69129
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
CVE-2026-84218 Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
CVE-2026-84218
CVE-2026-84218 affects Jolokia (org.jolokia/jolokia-core), a JMX-over-HTTP bridge. The flaw is in the JSR-160 proxy functionality, where the JNDI denylist introduced to mitigate CVE-2018-1000130 is incomplete. The denylist only rejects URLs matching service:jmx:rmi:///jndi/ldap:.*, but attacker-c...
CVE-2026-84218
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
PT-2026-84229
A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...
CVE-2026-81719
opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...
CVE-2026-81097
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...
EUVD-2026-67057
opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...
EUVD-2026-67025
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...