300976 matches found
GHSA-H44J-F5R5-PH73 n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector
Impact The AI Agents feature did not enforce the "Allowed HTTP Request Domains" restriction configured on credentials. As a result, a member-level user who had been granted use-only access to a shared credential could cause its secret to be sent to an external server they control, by pointing an...
Improper Check for Certificate Revocation
Overview io.netty:netty-handler-ssl-ocsp is a Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in t...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths in SVG images encoded as data-URI. An attacker can access arbitrary files from the server's filesystem by embedding a reference to a local file within a base64-encoded SVG image,...
Dompdf: File existence oracle via font-face stylesheet declaration
Description Dompdf is vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious HTML that references local files via the file:// protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw ...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through improper validation in the validateLocalUri function. An attacker can access files outside of intended directory restrictions by crafting file paths that exploit prefix-based chroot checks. Details A Director...
MAL-2026-11000 Malicious code in application-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07fa5354b40e3efac6ff8738892aa26cb710e6aff3caca516f563502ef4a4d43 On npm install, scripts.postinstall runs test.js which performs three attacker-beneficial actions against the installer's host. 1 Backdoor: fetches a...
MAL-2026-11007 Malicious code in web3-terminal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...
GO-2026-6023 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve...
GO-2026-6038 Gitea: Two SSRF findings in gitea.dev
Gitea: Two SSRF findings in gitea.dev...
GO-2026-6016 oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen
oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code in github.com/oapi-codegen/oapi-codegen...
GO-2026-6030 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea...
Malicious code in app-data-ist (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...
GHSA-H95V-H523-3MW8 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-59883 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
GHSA-G446-98W2-8P5W vulnerabilities
Vulnerabilities for packages: nextcloud-server...
GHSA-F283-GHQC-FG79 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
GHSA-94PJ-82F3-465W vulnerabilities
Vulnerabilities for packages: nextcloud-server...
GHSA-WM3W-8RRP-J577 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2026-13074
An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...
CVE-2026-13078
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...