23292 matches found
CVE-2026-67424 Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...
CVE-2026-67424
Flyto2 Core exposes a Redirect/SSRF issue in HTTP modules http.get, http.request, and http.batch (files src/core/modules/atomic/http/get.py, http/request.py, http/batch.py). Prior to version 2.26.7, these modules validate only the initial URL and then follow redirects with allow_redirects=True wi...
CVE-2026-54661
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
CVE-2026-54664
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas..enumi values to Ts.StringValue in src/configuration.ts without escaping before...
ROOT-APP-MAVEN-CVE-2022-42004 CVE-2022-42004 in io.root.com.fasterxml.jackson.core:jackson-databind - Patched by Root
Root has patched CVE-2022-42004 in the io.root.com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...
EUVD-2026-50332
@fastify/forwarded resolves client addresses from the X-Forwarded-For header. In versions before 3.0.2, when the header contains two or more comma separated entries, the parser trims only space characters and does not strip horizontal tabs, even though RFC 7230 defines optional whitespace as both...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.14: python-unversioned-command-3.14.6-2.1.hum1 noarch python3-3.14.6-2.1.hum1 aarch64, x8664 python3-debug-3.14.6-2.1.hum1 aarch64, x8664 python3-devel-3.14.6-2.1.hum1 aarch64, x8664...
CVE-2026-50641
Streamsoft Business Intelligence (BI) stores users’ passwords in plaintext in the database. The issue is mitigated in version 6.8.0.0, and users were also prompted to change their password on first login. Impact is Confidentiality (high) with no reported impact to integrity or availability. The a...
CVE-2026-50642
diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...
CVE-2026-58156 Apache Traffic Server: URL and port parsing errors allow access-control bypass
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fi...
Vite - Arbitrary File Read
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...
ROOT-OS-DEBIAN-13-CVE-2025-39841 CVE-2025-39841 in rootio-linux - Patched by Root
Root has patched CVE-2025-39841 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-71068 CVE-2025-71068 in rootio-linux - Patched by Root
Root has patched CVE-2025-71068 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-38539 CVE-2025-38539 in rootio-linux - Patched by Root
Root has patched CVE-2025-38539 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-40064 CVE-2025-40064 in rootio-linux - Patched by Root
Root has patched CVE-2025-40064 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-40044 CVE-2025-40044 in rootio-linux - Patched by Root
Root has patched CVE-2025-40044 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-71077 CVE-2025-71077 in rootio-linux - Patched by Root
Root has patched CVE-2025-71077 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...
ROOT-OS-DEBIAN-13-CVE-2025-39700 CVE-2025-39700 in rootio-linux - Patched by Root
Root has patched CVE-2025-39700 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...