12711 matches found
PT-2026-105490
Summary The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button,...
The vulnerability of the Open() function in the modules/uri/uri.go file of the Git repository management system Gitea, which allows a hacker to disclose protected information
The vulnerability of the Open function in the modules/uri/uri.go file of the Git repository management system Gitea is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...
PT-2026-104184
Name of the Vulnerable Software and Affected Versions WP Statistics versions prior to 14.16.15 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs via the REQUEST URI query-parameter key, enabling t...
Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability (cisco-sa-sdwan-webauth-xr8beuuU)
According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - An authentication bypass vulnerability exists in the API session-based authentication management of Cisco Catalyst SD-WAN Manager due to improper handling of URI encoding hex encoding in HTTP...
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CLSA-2026-1790893546 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.2-tuxcare.3...
GO-2026-6492 RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go...
CLSA-2026-1790876894 TuxCare security update for fast-uri (3 CVEs)
TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.1.2-tuxcare.2...
github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
A flaw was found in oauth2-proxy. When configured in reverse-proxy mode without explicit trusted proxy settings, the application defaults to treating all incoming network traffic as originating from trusted proxies. A remote, unauthenticated attacker can exploit this issue by sending a request wi...
CLSA-2026-1790870000 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.3-tuxcare.3...
CLSA-2026-1790869753 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 2.4.0-tuxcare.4...
fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization
A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...
fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization
A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...
fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding
A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...
fast-uri: fast-uri: Host confusion via skipped IDN canonicalization
A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...
fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...
CLSA-2026-1790864817 TuxCare security update for fast-uri (1 CVE)
TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 3.1.5-tuxcare.3...
CLSA-2026-1790863104 TuxCare security update for fast-uri (2 CVEs)
TuxCare rebuilt fast-uri to address 2 CVEs. Fixed in 3.1.3-tuxcare.2...