88 matches found
PT-2026-96715
Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A path traversal issue exists in the Screenshot Handler component within the static content function of the changedetectionio/flask app.py file. A remote attacker can exploit thi...
CVE-2026-87289
Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...
CVE-2026-87289
CVE-2026-87289 affects the helidon-webserver-static-content component of Oracle Helidon (Oracle Fusion Middleware), versions 4.0.0 through 4.5.4 . An unauthenticated attacker with network access via HTTP can trigger a hang or frequently repeatable crash, resulting in a complete denial of service ...
EUVD-2026-79938
Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...
com.buralotech.oss.identifier:buralotech-identifier-helidonmp (>=3.1.0, <=3.1.1), com.open-elements:recordstore-server (>=0.1.0, <=0.10.0) +46 more potentially affected by CVE-2026-87289 via io.helidon.webserver:helidon-webserver-static-content (>=4.0.0-m2, <=4.5.4)
io.helidon.webserver:helidon-webserver-static-content MAVEN version =4.0.0-m2, =3.1.0, =0.1.0, =1.15.0.516, =0.4.0, =1.2-rc4, =0.11, =1.0.0, =1.4.0, =1.0.0, =4.0.0-m2, =4.0.0-m2, =4.0.0-rc2, =4.0.0-m2, =4.5.4 and more Source cves: CVE-2026-87289 Source advisory:...
io.helidon:helidon-all (27.0.0-m1) potentially affected by CVE-2026-87289 via io.helidon.webserver:helidon-webserver-static-content (27.0.0-m1)
io.helidon.webserver:helidon-webserver-static-content MAVEN version 27.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.helidon.webserver:helidon-webserver-static-content and may be impacted: - io.helidon:helidon-all 27.0.0-m1 Source cves:...
PT-2026-93109
Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-webserver-static-content component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can lead to a han...
CVE-2026-87289: Uncontrolled Resource Consumption
Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-static-content. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attac...
PT-2026-79087
Name of the Vulnerable Software and Affected Versions Catalyst::Plugin::Static::Simple versions through 0.38 Description The serve static function always sets the Cache-Control header to "public", which cannot be overridden. This informs proxies that content can be stored in a shared cache and...
SUSE CVE-2026-34786
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a...
CVE-2026-34786
A flaw was found in Rack. A remote attacker can exploit this vulnerability by sending a specially crafted request with a URL-encoded static path. This bypasses security-relevant response headers intended for static content, potentially leading to information disclosure or other unintended...
DEBIAN-CVE-2026-34786
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a...
CVE-2026-34786
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a...
PT-2026-29915
Summary Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or...
Malicious code in static-content-cannabis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad874c892146b9bd12da1a27cfcf9bb790ac0fa7f7e82c795585e7343806eb1b The package static-content-cannabis was found to contain malicious code...
MAL-2026-1856 Malicious code in static-content-cannabis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad874c892146b9bd12da1a27cfcf9bb790ac0fa7f7e82c795585e7343806eb1b The package static-content-cannabis was found to contain malicious code...
CVE-2020-10112
Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which implies that those cached...
EUVD-2023-35382
Malicious code in bioql PyPI...