112132 matches found
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Summary Poweradmin v4.3.2 uses the attacker-controlled HTTPHOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirecturi sent to the Identity Provider,...
CVE-2026-67185
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...
CVE-2026-67183 TinyWeb 0.0.8 Memory Leak DoS via HTTP Request Handling
TinyWeb through 0.0.8 contains a memory leak vulnerability that allows unauthenticated attackers to exhaust available memory by sending ordinary well-formed HTTP requests. Each request causes HttpParser::execute to allocate Url objects, HttpHeaders objects, and HttpHeader instances via raw new...
CVE-2021-32088
creationtimestamp| type| source ---|---|--- 2026-07-28 16:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrpsyo4kcc2z...
CVE-2026-66754
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...
CVE-2026-51269
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
EUVD-2026-49888
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...
CVE-2026-63727
creationtimestamp| type| source ---|---|--- 2026-07-28 16:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrprsqvyp52o...
CVE-2026-43910
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...
CVE-2026-15014
creationtimestamp| type| source ---|---|--- 2026-07-28 15:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrppqxciid2s...
CVE-2026-66920
creationtimestamp| type| source ---|---|--- 2026-07-28 15:18:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrppgfssut2i...
CVE-2026-67178
MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect directive appends any portion of the requested path that follows the matched prefix to the configur...
CVE-2026-62423
creationtimestamp| type| source ---|---|--- 2026-07-28 15:02:56+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrpol6b4fn24 2026-07-29 13:55:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrs3axvf5z24 2026-07-30 04:45:20+00:00| seen|...
CVE-2026-13440
creationtimestamp| type| source ---|---|--- 2026-07-28 14:42:41+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrpngwmbxe23 2026-07-28 17:13:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrpvv2eqdh23...
CVE-2026-58221
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27 2026-07-29 12:45:02+00:00| seen| https://www.acn.gov.it/portale/w/nuove-vulnerabilita-in-samba-1 2026-08-01 21:40:36+00:00| seen|...
CVE-2026-58218
creationtimestamp| type| source ---|---|--- 2026-07-28 14:25:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrpmhj66mu27 2026-07-31 12:01:51+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrwvu4gbhz2t...
CVE-2026-67173
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve th...
CVE-2026-67173
Pivotick exposes a URI handling flaw in graph rendering: node imagePath values derived from graph data are not validated for their URL schemes before being assigned to SVG image resources. An attacker could supply crafted graph data to cause an image path to point to a malicious URI, and when a v...
MAL-2026-11141 Malicious code in lib-streak-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...