Open Redirect

Overview koa is a Koa web app framework Affected versions of this package are vulnerable to Open Redirect via the "back redirect" functionality. An attacker can cause users to be redirected to an external, attacker-controlled domain by supplying a specially crafted Referer header containing a...

CVE-2025-62427

The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestU...

Angular SSR has a Server-Side Request Forgery (SSRF) flaw

Impact The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr. The function createRequestUrl uses the native URL constructor. When an incoming request path e.g., originalUrl or url begins with a doub...

GHSA-Q63Q-PGMF-MXHR Angular SSR has a Server-Side Request Forgery (SSRF) flaw

Impact The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr. The function createRequestUrl uses the native URL constructor. When an incoming request path e.g., originalUrl or url begins with a doub...

CVE-2025-62427

The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestU...

CVE-2025-62427

CVE-2025-62427 describes a Server-Side Request Forgery in Angular SSR. The vulnerability arises in the @angular/ssr package where createRequestUrl uses the native URL constructor; if an incoming request path starts with // or \, the URL becomes schema-relative, causing the attacker-controlled hos...

EUVD-2019-15376

Malware in sbrugna...

EUVD-2023-27443

Malicious code in bioql PyPI...

EUVD-2025-6727

Malicious code in bioql PyPI...

Malicious code in node-db-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45ff3c4bbc7432de4b939c5c4f4553b07da3f84986979516af118b1da40fb264 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-converter (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security f1d0f1e58621f901f465807f834a6aa7b8af91e5626694d0a9e08586b9c2e010 This package is malicious and executes arbitrary code from an attacker controlled domain...

MAL-2025-47873 Malicious code in node-converter (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security f1d0f1e58621f901f465807f834a6aa7b8af91e5626694d0a9e08586b9c2e010 This package is malicious and executes arbitrary code from an attacker controlled domain...

Linux Distros Unpatched Vulnerability : CVE-2020-12667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an attacker- controlled server, aka an NXNSAttack issue. This is triggered...

📄 SeoToaster 2.5.0 Open Redirection

SeoToaster version 2.5.0 suffers from an open redirection vulnerability. Exploit Title: Open Redirect "Login Page" Functionality - seotoasterv2.5.0 Date: 07/2025 Exploit Author: Andrey Stoykov Version: 2.5.0 Tested on: Debian 12 Blog: https://msecureltd.blogspot.com/ Open Redirect "Login Page"...

CVE-2023-28799

A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this parameter, which would redirect the user after auth and send the authorization token to the redirected domain...

Fast-JWT Improperly Validates iss Claims

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

GHSA-GM45-Q3V2-6CF8 Fast-JWT Improperly Validates iss Claims

Summary The fast-jwt library does not properly validate the iss claim based on the RFC https://datatracker.ietf.org/doc/html/rfc7519page-9. Details The iss issuer claim validation within the fast-jwt library permits an array of strings as a valid iss value. This design flaw enables a potential...

Malicious code in @supera/share (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c348a3e52ca7aa30cd6b9bd7234d6385f1305e8c0f04c400ff236df303f06628 Any computer that has this package install...

Malicious code in @supera/aaaaaaaaaaa (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d347fb8b1e6f331c8dc5ba623c0b5f80932085711d95fd7e3f209c5180b5f79e Any computer that has this package install...

Malicious code in @supera/asjnakwndlja (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe6ab5a3ff2b2c90cfb7b31837f77cab7b08963f47908e8f5f34e9280b20fe2e Any computer that has this package install...