GHSA-V8VW-GW5J-W7M6 MCP Registry has open redirect via protocol-relative path in trailing-slash middleware

Summary The TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path e.g., //evil.com/ that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an...

PT-2026-6186

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.111 Description Claude Code, an agentic coding tool, had a flaw in how it checked the trustworthiness of web addresses when making WebFetch requests. The application used a startsWith function to confirm trust...

INFERMAL: Inferential Analysis of Maliciously Registered Domains

Cybercriminals have long depended on domain names for phishing, spam, malware distribution, and botnet operation. To facilitate the malicious activities, they continually register new domain names for exploitation. Previous work revealed an abnormally high concentration of malicious registrations...

Malicious code in antora-navigator-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea546d0e4728489bf022620518fcacbdeead708393058151148b3434c4651256 The package antora-navigator-extension was found to contain malicious code. Source: ossf-package-analysis...

CVE-2024-13999

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory AD or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromi...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.1.3 that stems from the disclosure of...

MAL-2025-48492 Malicious code in ec-component-loader (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-6087

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

GHSA-RVPW-P7VW-WJ3M OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

CVE-2025-6087 SSRF vulnerability in opennextjs-cloudflare via /_next/image endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature in the Cloudflare adapter for Open Next, which allowed unauthenticated users to proxy arbitrary remote content via the /next/image endpoint...

Malicious code in emergency-pull-request-probot-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Phish-Friendly Domain Registry “.top” Put on Notice

The Chinese company in charge of handing out domain names ending in ".top" has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of...

Malicious code in uxcamreactexample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 75476f3b67d0bc9c961d33e6be1f5a3728b33a076d896f36e401b8ff259ab9ee The OpenSSF Package Analysis project identified 'uxcamreactexample' @ 5.1.1 npm as malicious. It is considered malicious because: - The package...

CVE-2023-48114

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name...

Malicious code in puppet-module-posix-system-r (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ad3a13f7c087320a9f4bf76203fd40172a2b55172dec3ac957ad4d265c01425 The OpenSSF Package Analysis project identified 'puppet-module-posix-system-r' @ 1.0.0 rubygems as malicious. It is considered malicious because...

Malicious code in not-a-real-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 784465edafb8e247845de45eb1f9c8d0b19b03706e98e861f1a570732d66cba5 The OpenSSF Package Analysis project identified 'not-a-real-dep' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

HCL Technologies OneTest Server 安全漏洞

HCL Technologies OneTest Server is a software automation testing tool from HCL Technologies, India. It integrates test data, test environments, test runs and reports into a web-based browser for testers and non-testers. A security vulnerability exists in HCL Technologies OneTest Server versions...

Widespread credential phishing campaign abuses open redirector links

Microsoft has been actively tracking a widespread credential phishing campaign using open redirector links. Attackers combine these links with social engineering baits that impersonate well-known productivity tools and services to lure users into clicking. Doing so leads to a series of...

Security vulnerabilities fixed in Firefox ESR 60.8 — Mozilla

As part of his winning Pwn2Own entry, Niklas Baumstark demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. When an inner window is reused, it does not consider the use of document.domain for cross-origin...

EA Games Patches Account-Hijacking Bug

Researchers chained together two vulnerabilities in the Electronic Arts EA gaming platform and developed a proof-of-concept attack that allowed for possible account takeovers. A successful attack could allow a malicious actor to gain access to a user’s account and steal credit card information or...