CVE-2026-34207

CVE-2026-34207 The SSRF filter checked hostname text, but the actual destination was decided later by DNS. That gap let attacker-controlled Webhook URLs reach loopback, metadata, and private network targets. Intro I found this issue while reviewing Typebot , an open-source chatbot builder, with a...

MemorizingTrustManager

MemorizingTrustManager - Private Cloud Support for Your App MemorizingTrustManager MTM is a project to enable smarter and more secure use of SSL on Android. If it encounters an unknown SSL certificate, it asks the user whether to accept the certificate once, permanently or to abort the connection...

CVE-2026-78850

Matomo Authenticated SiteContentDetector Blind SSRF Reporter Name: CYBER-SEC Contact: [email protected] Summary Matomo allows an authenticated site administrator to configure a site's mainurl with an internal address. Any authenticated user with view access can later trigger...

Node.js 26.12.0 TLS Hostname Validation Bypass

A Python tool evaluates operator-reported Node.js version evidence for a TLS hostname validation bypass caused by fullwidth IPv4 digits...

Node.js 26.12.1 TLS Certificate Hostname Bypass Check

Node.js versions before 22.23.4, 24.22.1, and 26.12.1 contain a TLS certificate hostname validation flaw involving non-canonical IPv4 literals. This offline tool assesses operator-supplied Node.js version evidence against the fixed releases...

Node.js TLS Fullwidth-IP Hostname Validation Bypass

Node.js versions 24.x and 26.x contain a TLS hostname validation bypass when an IPv4 host uses fullwidth digits...

Exploit for CVE-2026-105483

node-cve-2026-105483-check Standalon...

Node.js Node encryption issues vulnerability

Node.js versions 24.22.0 and earlier, as well as 26.12.0 and earlier, contain an encryption-related vulnerability. This vulnerability arises because TLS hostname validation fails to treat hostnames containing non-ASCII characters—such as full-width digits—as IP addresses; instead, it matches them...

Node.js Node encryption issues vulnerability

Versions 22.23.3 and earlier of Node.js, 24.22.0 and earlier, and 26.12.0 and earlier contain an encryption vulnerability stemming from a flaw in TLS hostname validation: when the host is an invalid IPv4 address with a leading zero e.g., 0127.0.0.1, tls.checkServerIdentity interprets the leading...

Node.js Node encryption issues vulnerability

Versions 22.23.3 and earlier of Node.js, 24.22.0 and earlier, and 26.12.0 and earlier contain an encryption-related vulnerability stemming from improper TLS hostname validation. Specifically, tls.checkServerIdentity fails to recognize non-standard IPv4 hostname formats as valid IP addresses;...

CLSA-2026-1776878817 squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()

A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927

The Coder software versions before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 are vulnerable to a credential theft flaw. The root cause is an improper hostname validation in GetWorkspaceProxyByHostname, where a SIMILAR TO pattern performs a prefix match . This ...

EUVD-2026-103294

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...

CVE-2026-111927: Insufficiently Protected Credentials

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trust...