httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Summary There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. Details When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if ...

GHSA-HM5P-X4RQ-38W4 httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Summary There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. Details When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if ...

homeassistant-stubs (2022.8.7), mqtt-hass-base (>=4.0.0, <=4.0.7) +1 more potentially affected by CVE-2025-65713 via homeassistant (2022.8.7)

homeassistant PYPI version 2022.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.8.7 - mqtt-hass-base =4.0.0, =4.0.7 - pytest-homeassistant-custom-component 0.11.12 Source cves:...

homeassistant-stubs (2022.12.8), hydroqc2mqtt (>=0.7.1, <=0.8.0) +2 more potentially affected by CVE-2025-65713 via homeassistant (2022.12.8)

homeassistant PYPI version 2022.12.8 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.12.8 - hydroqc2mqtt =0.7.1, =0.8.0 - mqtt-hass-base 4.1.3 - pytest-homeassistant-custom-component 0.12.36...

homeassistant-stubs (2023.2.3), hydroqc2mqtt (>=0.11.2, <=0.11.3) +2 more potentially affected by CVE-2025-65713 via homeassistant (2023.2.3)

homeassistant PYPI version 2023.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.2.3 - hydroqc2mqtt =0.11.2, =0.11.3 - mqtt-hass-base 4.2.0 - pytest-homeassistant-custom-component 0.12.55...

httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Summary There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. Details When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if ...

ROS-20251223-7303

Vulnerability in 389-ds-base related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

📄 PKP-WAL 3.5.0-1 baseColour LESS Code Injection

PKP-WAL versions 3.5.0-1 and below suffer from a LESS baseColour related code injection vulnerability. ----------------------------------------------------------------- PKP-WAL = 3.5.0-1 baseColour LESS Code Injection Vulnerability -----------------------------------------------------------------...

WordPress BWL Knowledge Base Manager plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin BWL Knowledge Base Manager versions = 1.6.3...

PT-2025-53881

Name of the Vulnerable Software and Affected Versions xenioushk BWL Knowledge Base Manager versions through 1.6.3 Description The software contains a flaw related to improper input handling during web page creation, which allows for Stored Cross-site Scripting XSS. This means that malicious scrip...

CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the API Request component, which accepts user-supplied URLs and issues HTTP requests from the server without adequate filtering of internal or private network addresses. An attacker can access intern...

CVE-2025-66910

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...

Malicious code in foundations-theming-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58f9a087aa35c09a66eecf85d207eecd0a562d059891388be07c1b47f566db6 The package foundations-theming-base was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192630 Malicious code in foundations-theming-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58f9a087aa35c09a66eecf85d207eecd0a562d059891388be07c1b47f566db6 The package foundations-theming-base was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-204506

Malicious code in foundations-theming-base npm...

Malicious Package

Overview foundations-theming-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2025-66910

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...

CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

EUVD-2025-204545

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...