2332 matches found
CVE-2026-21791
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL...
MAL-2026-1320 Malicious code in chain-promised-await (npm)
Remote code execution via fetching code from a remote URL and Discord webhook usage indicates malicious intent. Single version adds to suspicion. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b882a33fdd394ef7a848100d8ee39ef4c7f0747942b4bea86e38af5780c978 The...
CVE-2025-70032
An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...
elysia 安全漏洞
Elysia is an open-source framework developed by Elysia. Versions of Elysia prior to 1.4.26 contained security vulnerabilities. These vulnerabilities were caused by defects in the regular expressions used in the t.String format for handling URLs, which could lead to denial-of-service attacks due t...
python3.9 security update
3.9.25-3.0.1.el97.1 - Remove upstream URL reference 3.9.25-3.1 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893...
PT-2026-24405
IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...
EUVD-2025-208383
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR...
CVE-2025-41772
The CVE-2025-41772 entry concerns the wwwupdate.cgi endpoint in UBR, where session tokens are exposed in plaintext in URL parameters. An unauthenticated remote attacker can obtain valid session tokens via the URL, enabling potential session hijacking. The connected CVE records confirm the vulnera...
CVE-2025-41772 wwwupdate.cgi Session token in URL
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR...
CVE-2025-41772 wwwupdate.cgi Session token in URL
An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR...
CVE-2025-70050
creationtimestamp| type| source ---|---|--- 2026-03-09 06:07:36+00:00| seen| https://gist.github.com/zcxlighthouse/12809648370f0e08d71434ff419df28e 2026-03-09 15:16:15+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-70050...
CVE-2025-70037
creationtimestamp| type| source ---|---|--- 2026-03-09 05:48:15+00:00| seen| https://gist.github.com/zcxlighthouse/0ca0e8750ad14964fa0ce24137ed346d 2026-03-09 16:16:11+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2025-70037...
MBS多款产品 安全漏洞
MBS UBR-01 Mk II, etc., are products of the German MBS company. The MBS UBR-01 Mk II is a remote base station device. The MBS UBR-02 is also a remote base station device. The MBS UBR-LON is a communication interface device for industrial automation systems. Several MBS products have security...
CVE-2025-70037
An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in linagora Twake v2023.Q1.1223. This allows attackers to obtain sensitive information and execute arbitrary code...
CVE-2026-3662
creationtimestamp| type| source ---|---|--- 2026-03-07 17:14:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgida3hz4s2d...
CVE-2026-29185
Backstage's CVE-2026-29185 affects the SCM URL parsing logic in the Backstage integration component. Before version 1.20.1, encoded path traversal sequences could be included in SCM URLs and, when processed by integration functions that construct API URLs, cause traversal segments to redirect req...
CVE-2026-30828 Wallos: SSRF via url parameter leading to File Traversal
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2...
CVE-2026-30828
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2...
CVE-2026-30247
WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, the application's "Import document via URL" feature is vulnerable to Server-Side Request Forgery SSRF through HTTP redirects. While the backend implements comprehensive UR...