145291 matches found
Fedora 44 : python-cssselect2 / weasyprint (2026-309c4b78a1)
The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-309c4b78a1 advisory. Update to latest upstream version of WeasyPrint and python-cssselect2. This update fixes CVE-2026-55073 Server-Side Request Forgery Tenable has extracted the...
auto-repeater
AutoRepeater: تكرار طلبات HTTP تلقائيًا مع Burp Suite باختصار داخل Extender قم باستيراد AutoRepeater.jar بعض التعليمات المختصرة سيعيد AutoRepeater إرسال الطلبات التي يتم تغييرها بواسطة استبدال محدد فقط. عندما يستلم AutoRepeater طلبًا يطابق الشروط المحددة لتبويب معيّن، سيطبّق أولاً كل استبدال أساس...
spring-break_cve-2017-8046
spring-breakcve-2017-8046 هذا برنامج بلغة Java يستغل ثغرة Spring Break CVE-2017-8046. تمت كتابة هذا البرنامج ليكون بأقل اعتماديات خارجية قدر الإمكان. إخلاء مسؤولية هذه الأداة مخصصة لمهندسي الأمن وأفراد أمن التطبيقات لأغراض التقييم الأمني. يُرجى استخدام هذه الأداة بمسؤولية. أنا لا أتحمل أي مسؤولية...
EUVD-2026-91802
A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...
CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
NPM: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL vulnerability discovered by ? in WordPress Npm trigger.dev versions 4.5.2...
CVE-2026-39718 WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6...
EUVD-2026-91774
Cross-Site Request Forgery CSRF vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6...
CVE-2026-39718
The Webriti Wallstreet WordPress theme is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects versions from the initial release through 2.8.6 . The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. No specific expl...
CVE-2020-37278 Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...
EUVD-2020-31274
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such a...
Security Bulletin: Vulnerability in i18next-http-middleware bundled with IBM Fusion and IBM Fusion HCI.
Summary IBM Fusion and IBM Fusion HCI include the i18next-http-middleware library, which is affected by multiple vulnerabilities, including prototype pollution, CRLF injection, and server-side request forgery vulnerabilities. CVE-2026-48714, CVE-2026-41683, CVE-2026-41690, CVE-2026-42353...
Security Bulletin: Vulnerability in axios bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.
Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the axios library, which is affected by multiple vulnerabilities, including server-side request forgery, prototype pollution, and denial of service vulnerabilities. CVE-2026-44486, CVE-2026-44487, CVE-2026-44488,...
Security Bulletin: Vulnerability in aiohttp bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage.
Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the aiohttp library, which is affected by multiple vulnerabilities, including HTTP request smuggling and out-of-bounds read vulnerabilities. CVE-2026-69243, CVE-2026-69244. Vulnerability Details CVEID:CVE-2026-69243...
CVE-2026-94485
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL...
Exploit for Argument Injection in Thecodingmachine Gotenberg
CVE-2026-40281 Gotenberg --- 📖 Table of...
CVE-2026-104611
A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fastsettinginternetset of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carrie...