32 matches found
AFD
AFD CVE-2022-24494 이 취약점은 임의 메모리 읽기arbitrary memory read입니다. 근본 원인은 사용자 영역user-land에서 제공된 메모리 주소에 대한 검증이 없다는 점이며, 이 주소는 memcpy 작업에서 해당 메모리 주소의 데이터를 풀 메모리pool memory로 복사하는 데 사용됩니다. 검사가 누락된 위치는 Afd!AfdTliIoControl+0x40B 입니다. 위 스크린샷에서 볼 수 있듯이, 사용자 영역 메모리 주소는 InputBuffer+0x20에서 처음 복사될 때...
Win10Pcap-Exploit
Win10Pcap-Exploit 크레딧 https://twitter.com/R00tkitSMM [email protected] 텔레그램 사용자 이름 : https://telegram.me/firozi 며칠 전 저는 win10pcap 드라이버에서 권한 상승으로 이어질 수 있는 취약점을 발견했습니다. 취약점을 보고했고 이제 버그는 수정되었습니다: www.win10pcap.org/download/ 그래서 샘플 익스플로잇을 공개하기로 결정했습니다. Win10Pcap은 WinPcap 기반의 새로운 이더넷 패킷 캡처...
CVE-2026-81016
This vulnerability affects the Linux kernel's AMD Platform Management Controller (PMC) driver (platform/x86/amd/pmc). The function amd_stb_s2d_init() discards return values from several S2D SMU commands. When the SMU refuses a command, the S2D_PHYS_ADDR_LOW/HIGH return values are ignored, leaving...
CVE-2026-9081 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...
CVE-2026-11835
Time-of-check time-of-use TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM UpdateResetFlow::run in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configur...
Security update for wget
This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...
CVE-2026-13147
The Kirki WordPress plugin before version 6.0.12 is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a lack of URL validation when the plugin processes a user-supplied URL via the kirki_get_apis function. This flaw allows unauthenticated attackers to force the server to issu...
PYSEC-2026-2940 PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
Summary FileTools.downloadfile in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream with followredirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata...
PYSEC-2026-2507 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
Summary The ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional co...
EUVD-2026-37875
An OS Command Injection vulnerability exists in LMS LAN Management System before commit 9fcb4de due to an IP address parameter being passed to the "exec" function without proper validation, allowing attackers to execute arbitrary operating system commands...
EEF-CVE-2026-48858 ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
Summary Server-Side Request Forgery SSRF vulnerability in Erlang/OTP ftp ftp\internal module allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address. The ftp\internal:handle\ctrl\result/2 PASV handler mode=passive, ipfamily=inet, ftp\extension=false extracts the IP address...
CVE-2026-5066
A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem subsys/net/lib/sockets/socketstls.c. When the TLS session cache is enabled, tlssessionstore and tlssessionrestore memcpy the caller-supplied address into a fixed-size buffer using the...
CVE-2026-48153
Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipping the blacklist.isBlacklisted check that every other outbound fetch path in the codebase uses. The Joi schema for the OAuth2 URL has no...
i18next-locize-backend 路径遍历漏洞
i18next-locize-backend is an open-source plugin for internationalization resource loading and key storage by locize. Versions of i18next-locize-backend prior to 9.0.2 had a path traversal vulnerability. This vulnerability arises from directly inserting lng, ns, projectId, and version into the URL...
CVE-2026-42140
PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery SSRF. The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does...
CVE-2026-42140
The CVE covers the PlantUML Macro used in XWiki, where the vulnerability lies in the server parameter not being validated. Prior to version 2.4.1, an attacker can supply an arbitrary URL (including internal addresses) to the server parameter, causing the XWiki server to attempt to connect for ren...
EUVD-2026-25389
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall feature in ClusterPolicy automatically attaches the admission controller's ServiceAccount token to outgoing HTTP requests. The service URL has n...
EUVD-2026-21513
PraisonAIAgents: SSRF via unvalidated URL in webcrawl httpx fallback...
CVE-2026-34954
PrašionAI (praisonaiagents) contains a SSRF vulnerability in FileTools.download_file(): it only validates the destination path and passes the unvalidated url directly to httpx.stream() with follow_redirects=True, allowing an attacker-controlled URL to reach any host accessible from the server, in...
