PYSEC-2026-2430 Crawlee for Python: SSRF via sitemap-derived URLs

Overview - Vulnerability type: Blind SSRF - Affected components: src/crawlee/utils/sitemap.py, src/crawlee/utils/robots.py, src/crawlee/requestloaders/sitemaprequestloader.py, and all built-in HTTP clients. - Trigger: an attacker-controlled sitemap or robots.txt containing a URL that points to an...

CVE-2021-27404

Askey RTF8115VW BRSVg11.11RTFTEF001V6.54V014 devices allow injection of a Host HTTP header...

EUVD-2018-10505

Malware in sbrugna...

EUVD-2021-14159

Malware in sbrugna...

EUVD-2012-3776

Malware in sbrugna...

EUVD-2025-20239

Malicious code in bioql PyPI...

EUVD-2024-2827

Malicious code in bioql PyPI...

EUVD-2025-20237

Malicious code in bioql PyPI...

CVE-2025-43794: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote authenticated attackers...

CVE-2025-43933

fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43932

JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43930

Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43932: Weak Password Recovery Mechanism for Forgotten Password

JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43930: External Control of Assumed-Immutable Web Parameter

Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43930

Hashview 0.8.1 allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43931: Weak Password Recovery Mechanism for Forgotten Password

flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43933: External Control of Assumed-Immutable Web Parameter

fblog through 983bede allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2025-43931

flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVERNAME is not configured and thus a reset depends on the Host HTTP header...

CVE-2012-3829

Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header...

CVE-2012-2212

McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details for the vulnerable...