LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

Summary A redirect-based Server-Side Request Forgery SSRF bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metada...

EUVD-2025-208115

An arbitrary file upload vulnerability in the subtitle loading function of asbplayer v1.13.0 allows attackers to execute arbitrary code via uploading a crafted subtitle file...

CVE-2026-27795

LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery SSRF bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow redirects...

CVE-2026-27795 LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery SSRF bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow redirects...

CVE-2026-27795 LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery SSRF bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow redirects...

CVE-2026-3147

CVE-2026-3147 affects libvips up to version 8.18.0. The vulnerability is in vips_foreign_load_csv_build (libvips/foreign/csvload.c) and causes a heap-based buffer overflow via CSV loading. The vulnerability requires local access. An exploit has been made public, and a patch exists (commit b3ab458...

EUVD-2026-8604

A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vipsforeignloadmatrixheader of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is...

CVE-2025-69771

Cross-Site Scripting XSS vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrary JavaScript in the context of the active streaming platform via a crafted .srt subtitle file. Because the script executes within the...

LangChain.js code issues and vulnerabilities

LangChain.js is an open-source implementation of a context-aware reasoning application developed by LangChain. Versions of LangChain.js prior to 1.1.8 contained code vulnerabilities. These vulnerabilities stemmed from the RecursiveUrlLoader component, which allowed unauthorized access to...

PT-2026-36799

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.17.1 Description A heap out-of-bounds read issue exists in the GGUF model loader. An unauthenticated remote attacker can exploit this by providing a specially crafted GGUF file via the '/api/create' endpoint where th...

PT-2026-21934

Name of the Vulnerable Software and Affected Versions asbplayer version 1.13.0 Description An arbitrary file upload issue exists in the subtitle loading function. Successful exploitation allows attackers to execute arbitrary code by uploading a specially crafted subtitle file. Recommendations At...

CLSA-2026-1771956748 gimp: Fix of CVE-2025-15059

CVE-2025-15059: fix PSP file loader to validate channel types for grayscale images, preventing invalid memory access from incorrect offset computation...

CLSA-2026-1771956020 gimp: Fix of CVE-2025-15059

CVE-2025-15059: fix PSP file loader to validate channel types for grayscale images, preventing invalid memory access from incorrect offset computation...

Developer-targeting campaign using malicious Next.js repositories

Microsoft Defender Experts identified a coordinated developer-targeting campaign delivered through malicious repositories disguised as legitimate Next.js projects and technical assessment materials. Telemetry collected during this investigation indicates the activity aligns with a broader cluster...

Malicious code in locale-loader-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfe4223d443a4180a9c6113449817f38d1d72fcd6f2f4cb42525dcb391c82b5 The package locale-loader-pro was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview locale-loader-pro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-963 Malicious code in locale-loader-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfe4223d443a4180a9c6113449817f38d1d72fcd6f2f4cb42525dcb391c82b5 The package locale-loader-pro was found to contain malicious code. Source: ghsa-malware...

ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT Malware

Cybersecurity researchers have disclosed details of a new ClickFix campaign that abuses compromised legitimate sites to deliver a previously undocumented remote access trojan RAT called MIMICRAT aka AstarionRAT. "The campaign demonstrates a high level of operational sophistication: compromised...

Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

Impact This is a remote code execution RCE vulnerability. Node.js automatically imports /.plugin.js,mjs files including those from nodemodules, so any malicious package with a .plugin.js file could execute arbitrary code when installed or required. All projects using this loading behavior are...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2026-27100 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...