102890 matches found
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Overview org.webjars.npm:sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG through the generateKeyPairHex path in src/sm2/utils.js. An attacker can recover or predict SM2 private keys and signing nonces b...
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Overview sm-crypto is a sm-crypto Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG through the generateKeyPairHex path in src/sm2/utils.js. An attacker can recover or predict SM2 private keys and signing nonces by causing a...
GHSA-HFHX-W8P8-4HC7 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Budibase: SSRF via bare fetch in uploadUrl during AI table generation Summary The uploadUrl function in packages/server/src/utilities/fileUtils.ts uses a bare fetchurl call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachmen...
Server-side Request Forgery (SSRF)
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the uploadUrl function when processing attachment column values during AI table generation. An attacker can access internal network resources and sensitive...
GHSA-V42F-V8XC-J435 Budibase: SSRF via DNS rebinding in the REST datasource integration
Summary Budibase's central outbound-fetch guard fetchWithBlacklist prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and pinning the connection to the validated IP. The pin is implemented as a Node https.Agent makePinnedAgent. The fix...
Server-side Request Forgery (SSRF)
Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access...
Budibase: SSRF via DNS rebinding in the REST datasource integration
Summary Budibase's central outbound-fetch guard fetchWithBlacklist prevents SSRF/DNS-rebinding by resolving the target hostname, checking every resolved IP against the blacklist, and pinning the connection to the validated IP. The pin is implemented as a Node https.Agent makePinnedAgent. The fix...
Cross-site Request Forgery (CSRF)
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the confirmChatLinkSession process. An attacker can gain unauthorized access to another user's permissions and perform actions as that user by inducing th...
GHSA-PVCR-8MVP-W8QR Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
Summary The Budibase AI chat-link handoff flow GET/POST /api/chat-links/:instance/:token/handoff binds an external chat identity Slack/Discord/MS Teams/Telegram to a Budibase user account. The confirmation endpoint is on a public route no CSRF middleware, no auth-group gate and the only credentia...
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
Impact A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets by using DNS rebinding against two outbound fetch paths that are still not pinned to the validated DNS answer. The first path is OpenAPI query import. It validates the supplied...
Server-side Request Forgery (SSRF)
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch...
Server-side Request Forgery (SSRF)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the sanitizeproxypath process. An attacker can access unauthorized files or directories by submitting a specially crafted, deeply percent-encoded path parameter that bypass...
Weblate: SSRF via URL Parser Differential in `normalize_request_url` (wlc)
The Weblate CLI client wlc was found to be vulnerable to Server-Side Request Forgery SSRF due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalizerequesturl function, which was meant to validate that outgoing API requests stayed...
GO-2026-5606 Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF) in github.com/gohugoio/hugo
Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings SSRF in github.com/gohugoio/hugo...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the unstable RSC APIs. An attacker can execute unauthorized actions by tricking a user into submitting crafted requests. Note: This is only exploitable if the unstable RSC APIs are enabled in the...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the unstable RSC APIs. An attacker can execute unauthorized actions by tricking a user into submitting crafted requests. Note: This is only exploitable if the unstable RSC APIs are enabled in the...
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
Summary Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository or pull request containing a malicious...
EUVD-2026-44937
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...
