Open Redirect

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Open Redirect via the SSE and streamable HTTP transports, which follow redirects without restricting them to the MCP endpoint's origin. An attacker who can position a redirect for example via a...

CVE-2026-114134 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-CG8M-R9F2-5WM2 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-116774

The russh Rust SSH client and server library is vulnerable to a denial-of-service condition in versions 0.60.0 through 0.65.0 . The root cause is that channel-open parsing accepts a peer-declared maximum_packet_size of zero , which is then passed into ChannelTx::poll_writable in russh/src/channel...

CVE-2026-116774 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...

CVE-2026-116774

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...

CVE-2026-116774 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...

CVE-2026-116774 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data,...

android-forensics

android-forensics AFLogical OSE: Open source Android Forensics app and framework The Open Source Edition has been released for use by non-law enforcement personnel, Android aficionados, and forensics gurus alike. It allows an examiner to extract CallLog Calls, Contacts Phones, MMS messages,...

RainLab-User-Open-Redirect

RainLab User Plugin - Open Redirect Vulnerability Vulnerab...

CVE-2026-116578

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

EUVD-2026-108261

fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content...

Exploit for CVE-2026-1277

CVE-2026-1277 — URL Shortify Proof-of-Concept PoC explo...

Exploit for CVE-2026-1296

CVE-2026-1296 — Frontend Post Submission Manager Lite Proof...

synapse

========================================================================= Synapse |support| |development| |documentation| |license| |pypi| |python| Synapse is now actively maintained at element-hq/synapse Synapse is an open-source Matrix homeserver developed from 2019 through 2023 as part of the...

CVE-2026-116578

A flaw was found in Tornado. When an application configures RedirectHandler with dynamic URL templates, user-controlled input in request paths can alter the target redirect scheme or host location. A remote attacker can exploit this vulnerability by sending a crafted request to trigger an open...

reposaur

Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...

CVE-2025-32433

Security research on Erlang/OTP SSH CVE-2025-32433 Python exploit Proof-of-Concept CVE-2025-32433 Unauthenticated Remote Code Execution in Erlang/OTP SSH. I also have a banner grabbing Nuclei template and a Nuclei RCE check. The Suricata and Zeek IDS logs are in order based on a succesful Paramik...

CVE-2026-115921

A flaw was found in Open Neural Network Exchange ONNX. When performing shape inference on a machine learning model, the Scan operator does not safely validate the required numscaninputs attribute. An attacker can exploit this issue by supplying an untrusted model that omits this attribute or...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...