28109 matches found
PYSEC-2026-3387 Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements maxredirects, and removes only the Host header. It does not clear Authorization, authusername, authpassword, or authmode when the redirect target changes origin. As ...
CVE-2026-50168
A flaw was found in the @angular/platform-server package of Angular. This vulnerability allows remote attackers to bypass host allowlist constraints and direct server-side outgoing requests to arbitrary external endpoints. This occurs due to a parser differential between the strict WHATWG URL...
CVE-2026-22095
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22096
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...
CVE-2026-22103
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22103 Command injection in NPC start web endpoint
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22103
CVE-2026-22103 : The NPC start endpoint on the web server listening at port 8090 is vulnerable to command injection. The public CVSS v4.0 metrics indicate a base score of 9.3 (CRITICAL) with network attack vector, low attack complexity, no privileges required, and no user interaction. Impacts are...
CVE-2026-22103 Command injection in NPC start web endpoint
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...
EUVD-2026-43333
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22096 Missing authentication for webserver endpoints
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...
CVE-2026-22096 Missing authentication for webserver endpoints
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...
EUVD-2026-43328
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...
CVE-2026-22096
CVE-2026-22096 concerns a webserver running on port 8090 that does not require authentication, enabling sensitive information leakage (e.g., configured passwords) and file uploads via multiple endpoints. The Connected documents provide the same description across NVD and CVE records, with no vend...
CVE-2026-22095 Command injection in diagnosis web endpoint
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22095 Command injection in diagnosis web endpoint
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22095
The CVE-2026-22095 entry describes a command injection vulnerability in the network diagnosis endpoint of a web server listening on port 8090. Details from connected sources confirm the affected component is the diagnosis endpoint (web server) and that exploitation would allow command execution w...
EUVD-2026-43326
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection...
CLEANSTART-2026-JY51137 Security fixes for CVE-2026-27145, CVE-2026-39824, CVE-2026-42504, CVE-2026-42507 applied in versions: 1.0.10-r4, 1.0.10-r5
Multiple security vulnerabilities affect the wait-for-port package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-CA89903 Security fixes for CVE-2026-27145, CVE-2026-39824, CVE-2026-42504, CVE-2026-42507 applied in versions: 1.0.10-r4, 1.0.10-r5
Multiple security vulnerabilities affect the wait-for-port package. These issues are resolved in later releases. See references for individual vulnerability details...
