CVE-2026-100870

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870

Sylius versions prior to 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 are vulnerable to administrator password-reset poisoning. The software builds password-reset links using the request Host header without proper validation. This allows unauthenticated attackers to use forged Host headers to red...

CVE-2026-100870

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

CVE-2026-100870 Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

EUVD-2026-87942

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for know...

Malicious code in metrics-sdk (PyPI)

Source: kam193 1378dcfc94bda0e9beb3e3d66c0588967a164741686ab473826fbab077e7afb9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in metrio (PyPI)

Source: kam193 f7b0289ef68f815e0fd296282739990dfc918c0070fb5acdae2787ca8eba23f3 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

CVE-2026-100664

A flaw was found in Netty's HTTP/3 codec. When converting HTTP/1 requests to HTTP/3, the codec improperly prioritizes the Host header over the request-target authority. A remote, unauthenticated attacker can exploit this authority confusion by sending a request containing conflicting destination...

CVE-2026-100663

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. A remote attacker can bypass security policies and tunnel allowlists when Netty acts as an HTTP/1 to HTTP/3 proxy or gateway. Due to improper translation of HTTP/1 CONNECT requests, the component uses the attacker-controlled Host header ...

MAL-2026-17194 Malicious code in metrics-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60ce93696722d633e9eea7b3fac6f76ebe61a581bd2d1d79efb778f8cb015399 metricssdk 999.0.0 is a dependency-confusion beacon. setup.py runs on pip install and metricssdk/init.py runs on import metricssdk; both hex-encode t...

Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2v2p-6j97-cjg9. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In...

Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength...

GHSA-43RV-JRFH-9MRR Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength...

Uncaught Exception

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Uncaught Exception via the host-to-sandbox promise delivery path in lib/bridge.js, where a host promise reaching the sandbox through the construct...

Uncaught Exception

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Uncaught Exception via the host-to-sandbox promise delivery path in lib/bridge.js, where a host promise reaching the sandbox through...

CVE-2026-100724

http4k Maven package org.http4k:http4k-core before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring Contains matching on the Host header by default in reverseProxy and reverseProxyRouting when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP...

CVE-2026-100722

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...

CVE-2026-100723

The vm2 library before version 3.12.2 is vulnerable to a memory disclosure and corruption issue due to a failure in applying Buffer backing-store ownership invariants for host builtin modules. When an application exposes the zlib module via NodeVM's builtin allowlist, zlib.deflateSync can return ...