CVE-2026-102244: Server-Side Request Forgery (SSRF)

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-73659: Improper Limitation of a Pathname to a Restricted Directory

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-45552: Authorization Bypass Through User-Controlled Key

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.beforerequest → @jwtrequired app/routes/install/routes.py:36-39. The individual endpoints installexporter, installwaf, installgeoip,...

CVE-2026-7788 Axle-Bucamp MCP-Docusaurus document.py get_content path traversal

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function updatedocument/continuedocument/deletedocument/getcontent of the file app/routes/document.py. Performing a manipulation of the argument DOCSDIR/pa...

PT-2026-36937

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function update document/continue document/delete document/get content of the file app/routes/document.py. Performing a manipulation of the argument DOCS...

CVE-2026-7788: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function updatedocument/continuedocument/deletedocument/getcontent of the file app/routes/document.py. Performing a manipulation of the argument DOCSDIR/pa...

CVE-2026-33078: Improper Neutralization of Special Elements used in an SQL Command

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxysectionsave function in app/routes/config/routes.py. The serverip parameter, sourced from the URL path, is passed unsanitized through...

CVE-2024-8003: Deserialization of Untrusted Data

A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of the file internal/app/routes/routes.go of the component Log Handler. The manipulation leads to deserialization. The patch is identified as...

Server side request forgery (ssrf)

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the element method in app/routes.py does not validate the user-controlled srctype and elementurl variables and passes them to the send method which sends a GET request on lines 339-343 in request.py, which leads to a...

whoogle-search path traversal vulnerability

whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting metasearch engine. A path traversal vulnerability exists in whoogle-search versions prior to 0.8.4, which stems from the config function in app/routes.py that does not validate the user-controlled name variable and...

whoogle-search Cross-Site Scripting Vulnerability

whoogle-search is a software application. Self-hosted, ad-free, privacy-respecting meta-search engine A cross-site scripting vulnerability exists in whoogle-search versions prior to 0.8.4, which stems from the element method in app/routes.py that does not validate user-controlled srctype and...

OWASP NodeGoat 安全漏洞

OWASP NodeGoat is a project of the OWASP Foundation in the United States. It provides an environment to learn how the OWASP Top 10 security risks apply to web applications developed using Node. OWASP NodeGoat suffers from a security vulnerability that results in a denial of service due to unknown...

CVE-2021-4247: Improper Resource Shutdown or Release

A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the...

CVE-2021-4247

A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the...

Safemode Gem for Ruby is vulnerable to information disclosure

Safemode is initialised with an optional 'delegate' object. If the delegated object is a Rails controller, 'inspect' could be called which then exposes all informations about the App, including routes, secret tokens, caches and so on...