CVE-2026-116056

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function requesturlsafe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was...

EUVD-2026-109550

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function requesturlsafe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was...

CVE-2026-116056 KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery

A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function requesturlsafe of the file app/function/web.function.php of the component Remote Download. This manipulation causes server-side request forgery. It is possible to initiate the attack remotely. The vendor was...

CVE-2026-116056

A server-side request forgery (SSRF) vulnerability exists in KodCloud KodExplorer up to version 4.56 . The flaw is located in the request_url_safe function within the file app/function/web.function.php of the Remote Download component. An attacker can initiate this attack remotely to manipulate r...

CVE-2017-8759-exploits

CVE-2017-8759-exploits Two versions of CVE-2017-8759 exploits Example 1 - Downloads a .Net dll from a remote location without touching disk, loads and executes Example 2 - Loads an embedded .Net dll and executes...

Invoke-CradleCrafter

Invoke-CradleCrafter v1.1 Introduction Invoke-CradleCrafter is a PowerShell v2.0+ compatible PowerShell remote download cradle generator and obfuscator. Background In the Fall of 2016 after releasing Invoke-Obfuscation, I continued updating my spreadsheet of PowerShell remote download cradles...

MAL-2026-17710 Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

CVE-2026-102775

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key IDOR in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d download token and o order token parameters are checked for non-emptines...

Malicious code in bitcoin-address-utils (RubyGems)

RubyGems runs this gem's native extension script ext/bitcoin-address-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over...

AlmaLinux 9.6 [TuxCare] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / ant-apache-oro / etc (ALMALINUX9.6:CLSA-2026:1789746085)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789746085 advisory. - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to...

MAL-2026-17226 Malicious code in figlet-chalk-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5ccd0a988525d8128b520a46c4271e26ae5fe2f99accf28f37d4c7370b66de4 On every require'figlet-chalk-render', a top-level IIFE queries https://registry.npmjs.org/figlet-chalk-render/latest and, if a newer version exists,...

MAL-2026-17223 Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CVE-2026-101051

Cloudreve versions prior to 4.16.1 are vulnerable to a path traversal flaw during remote downloads. The application fails to properly sanitize file paths returned by remote downloaders, which allows authenticated users to exploit path traversal sequences in downloader metadata. This enables an at...

CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...

CLEANSTART-2026-OZ64651 ftp and scp tasks of Apache Ant can download files from a remote server

CVE-2026-78254 affects multiple packages. The ftp and scp tasks of Apache Ant can download files from a remote server. See references for individual vulnerability details...

Malicious code in transfomers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df75802d76ea42dd9a4e543e30565723bfaed892475cbeaca7ef561a67c1f0b3 Package name typosquats the popular transformers library. The distribution installs a .pth file into site-packages, which the Python interpreter...

MAL-2026-16131 Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in aitextkit-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e96f519e8acba48a6f7760b37a9ad70b94bfbf79fb5eac4fc682849b2837e3 The package presents itself as a small text-cleaning utility library, but both shipped implementation modules text.py and system.py consist of a...