105 matches found
mcp-chrome-bridge (hangwin/mcp-chrome) <= 1.0.31 - CORS Origin Bypass (CSWSH)
mcp-chrome-bridge =1.0.31 uses origin.startsWith for CORS, so origins like http://127.0.0.1.evil.com are wrongly allowed, letting attackers bypass CORS and access the local server. id: CVE-2026-102878 info: name: mcp-chrome-bridge hangwin/mcp-chrome = 1.0.31 - CORS Origin Bypass CSWSH author:...
cr (1.5.0), cryton-worker (2022.2.2) +5 more potentially affected by CVE-2026-44405 via paramiko (2.11.1)
paramiko PYPI version 2.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - cr 1.5.0 - cryton-worker 2022.2.2 - kubemarine =0.13.1, =1.2.60, =1.5.2, =1.9.0 Source cves: CVE-2026-44405 Source advisory: OSV:PYSEC-2026-285...
Summary: Security vulnerabilities
Summarize is a multi-source rapid summarization tool developed by Peter Steinberger. Versions of Summarize prior to 0.15.1 contain security vulnerabilities. These vulnerabilities stem from an authorization flaw in the content script’s window.postMessage bridging mechanism, which could allow...
cr (1.5.0), cryton-worker (2022.2.2) +5 more potentially affected by CVE-2026-44405 via paramiko (2.11.1)
paramiko PYPI version 2.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - cr 1.5.0 - cryton-worker 2022.2.2 - kubemarine =0.13.1, =1.2.60, =1.5.2, =1.9.0 Source cves: CVE-2026-44405 Source advisory:...
CVE-2021-22512
Cross-Site Request Forgery CSRF vulnerability in Micro Focus Application Automation Tools Plugin - Jenkins plugin. The vulnerability affects version 6.7 and earlier versions. The vulnerability could allow form validation without permission checks...
IBM Concert Software Information Disclosure
The vulnerability of IBM Concert Software’s artificial intelligence-based automation tools lies in the fact that system data can be disclosed to unauthorized individuals during the processing of HTTP headers. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to...
IBM Concert Software AI Automation Code Execution
The vulnerability of IBM Concert Software’s artificial intelligence-based automation tools is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected...
IBM Concert Software Uninitialized Pointer Use-After-Free
The vulnerability of IBM Concert Software’s artificial intelligence-based automation tools is related to improper cleaning of dynamic memory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
EUVD-2024-44290
Malicious code in bioql PyPI...
EUVD-2024-44291
Malicious code in bioql PyPI...
EUVD-2022-4636
Malicious code in bioql PyPI...
EUVD-2024-32740
Malicious code in bioql PyPI...
EUVD-2024-32765
Malicious code in bioql PyPI...
EUVD-2024-32745
Malicious code in bioql PyPI...
Pentest-scripts
Pentest-scripts Personal repository with offensive secur...
Malicious Package
Overview tgsendduo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a larger campaign targeting user credentials. It, and several other variations, masquerade as automation tools for soci...
Malicious Package
Overview idd-64bit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a larger campaign targeting user credentials. It, and several other variations, masquerade as automation tools for soci...
Malicious Package
Overview tidpz is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a larger campaign targeting user credentials. It, and several other variations, masquerade as automation tools for social...
Malicious Package
Overview t64z is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a larger campaign targeting user credentials. It, and several other variations, masquerade as automation tools for social...
Malicious Package
Overview postingduo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a larger campaign targeting user credentials. It, and several other variations, masquerade as automation tools for...