23268 matches found
MAL-2026-10532 Malicious code in fluterjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb8d561ceacd48c1883f6ec3151f5567240259b5ba54af3835fc0537f2f18933 The package's main and bin entry, server.js, starts an Express server bound to 0.0.0.0:10459 that exposes POST /ejecutar. The handler reads the JSON...
MAL-2026-10544 Malicious code in skrill-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...
PT-2026-58123
Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A heap-based buffer overflow exists in the Windows Bluetooth Port Driver. This issue allows an unauthorized attacker located on an adjacent network to execute arbitrary code and...
PT-2026-58009
Name of the Vulnerable Software and Affected Versions 1715-AENTR EtherNet/IP Adapter versions prior to 3.011 Description The 1715-AENTR EtherNet/IP Adapter exposes a network-accessible debug port that lacks proper privilege controls. This allows unauthenticated remote access to intrusive...
SIP Sustainable Irrigation Platform 5.x (cv) Settings Mass Assignment
Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...
PYSEC-2026-3061 Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port TCP 24282, hardcoded as 0x5EDA in constants.py. The server has no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach...
PYSEC-2026-2740 Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
Summary There is a blind server side request forgery in the functionality that allows editing an image via a prompt. The affected function will perform a GET request on the URL provided by the user. There is no restriction on the domain of the provided URL allowing the local address space to be...
PYSEC-2026-2443 dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens
Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens Summary The local OAuth helper FastAPI server bundled with dbt-mcp exposes the GET /dbtplatformcontext endpoint without any form of authentication or host-origin validation. After a user completes the OAuth login flow against dbt...
PYSEC-2026-3387 Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements maxredirects, and removes only the Host header. It does not clear Authorization, authusername, authpassword, or authmode when the redirect target changes origin. As ...
CVE-2026-22095
The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22103
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22096
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...
CVE-2026-22103 Command injection in NPC start web endpoint
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22103 Command injection in NPC start web endpoint
The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...
CVE-2026-22103
CVE-2026-22103 : The NPC start endpoint on the web server listening at port 8090 is vulnerable to command injection. The public CVSS v4.0 metrics indicate a base score of 9.3 (CRITICAL) with network attack vector, low attack complexity, no privileges required, and no user interaction. Impacts are...
CVE-2026-22096 Missing authentication for webserver endpoints
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...
CVE-2026-22096
CVE-2026-22096 concerns a webserver running on port 8090 that does not require authentication, enabling sensitive information leakage (e.g., configured passwords) and file uploads via multiple endpoints. The Connected documents provide the same description across NVD and CVE records, with no vend...
CVE-2026-22096 Missing authentication for webserver endpoints
The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...