curl: Unsanitized IPFS CID Allows SSRF Against Configured Gateway

Summary: ipfsurlrewrite in src/toolipfs.c decodes the host component CID of ipfs:// / ipns:// URLs using CURLUURLDECODE and then concatenates that decoded value directly into the gateway path aprintf"%s%s/%s%s", ... without normalization or validation. A crafted host value for example...

curl: AWS SigV4 Signature Disclosure via Verbose Logging in libcurl

Summary When libcurl is built with AWS SigV4 support, enabling verbose logging CURLOPTVERBOSE or --verbose causes the library to print both the string-to-sign and the final HMAC signature into logs. Because signatures remain valid for several minutes and are derived directly from AWS credentials,...

Nextcloud: WebAuthn app was updated based on public key

Vulnerability description not provided...

Mars: Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses

A publicly accessible JSON API endpoint was found to expose sensitive user information, including internal identifiers and email addresses. The vulnerability was classified as an information disclosure issue with a medium severity rating. The problem was remediated by implementing proper...

Arbitrary code execution during YAML config parsing in Kubernetes materializer

Summary The Kubernetes materializer entry point feast/sdk/python/feast/infra/computeengines/kubernetes/main.py deserializes /var/feast/featurestore.yaml and /var/feast/materializationconfig.yaml using yaml.load..., Loader=yaml.Loader. Because yaml.Loader eagerly instantiates arbitrary Python...

curl: SMTP Command Injection Vulnerabilities in curl

Summary Successfully reproduced SMTP command injection vulnerabilities in curl that allow attackers to inject arbitrary SMTP commands by using carriage return and line feed characters \r\n in email addresses. Vulnerabilities Confirmed 1. MAIL FROM Injection Description: Injection via --mail-from...

Nextcloud: Stored XSS Vulnerability via SVG File

A stored XSS vulnerability was discovered in Nextcloud related to the handling of SVG files. The vulnerability allowed the execution of arbitrary JavaScript code...

Node.js: Memory leak that enables remote Denial of Service against applications processing TLS client certificates

A memory leak was discovered in Node.js's OpenSSL integration when converting X.509 certificate fields to UTF-8 without freeing the allocated buffer. The vulnerability was triggered when applications called socket.getPeerCertificatetrue, causing steady memory growth through repeated TLS connectio...

Nextcloud: Mail stored HTML injection in subject text

A vulnerability was discovered in the mail stored HTML injection in subject text. The vulnerability allowed for arbitrary HTML code to be injected into the subject line of emails stored in the system...

Omise: 2FA requirement bypass when inviting team members

The application's requirement for users to enable 2FA before sending team invitations was bypassed by modifying client-side responses. This allowed invitations to be sent without enabling 2FA, defeating the security requirement...

curl: Race condition on global `gss_context` during SOCKS5 GSS-API negotiation in libcurl

Summary: Concurrent SOCKS5 GSS-API authentications share a file-scope global gsscontext without synchronization, causing data races and undefined behavior. - Global context defined at: 52:54:curl/lib/socksgssapi.c static gssctxidt gsscontext = GSSCNOCONTEXT; - Passed by address into the GSS init...

Sony: DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)

A DLL side-loading vulnerability was discovered in Sony Music Center for PC Ver. 2.7.2. The application insecurely searched for a missing DLL file in the system PATH environment, allowing an attacker with access to the victim's local machine to achieve arbitrary code execution by placing a...

curl: CVE-2025-10966: missing SFTP host verification with wolfSSH

Summary: When curl is built with the wolfSSH backend, the SSH/SFTP implementation in lib/vssh/wolfssh.c performs no server host key verification and exposes no host identity options in the curl tool. I verified this locally by building curl with wolfSSH binary reports wolfssh/1.4.20, observing th...

curl: Use-after-free when POST body buffer is freed before transfer

Summary: I locally reproduced a heap use-after-free in libcurl by setting CURLOPTPOSTFIELDSIZE and CURLOPTPOSTFIELDS to a heap buffer and then freeing that buffer before curleasyperform. AddressSanitizer ASan reports a heap-use-after-free read during the request send path. This demonstrates the...

U.S. Dept Of Defense: Cross-Site Scripting via URL on ███████

A Cross-Site Scripting XSS vulnerability was discovered on an official domain from the Department of Defense. The vulnerability could be exploited through the GET method, allowing an attacker to inject malicious scripts that could potentially be executed. No further details were provided...

SingleStore: Insecure Direct Object Reference (IDOR) allows creating folders.

An Insecure Direct Object Reference IDOR vulnerability was discovered in the backend API of a software product. The vulnerability allowed authenticated users with low privileges to create unauthorized folders and files in other users' workspaces within the same organization. The issue was reporte...

SingleStore: Delete any folder for any user within the organization

A vulnerability in the SingleStore backend API allowed low-privileged users to delete folders belonging to other users within the same organization by manipulating the folderid parameter in DELETE requests. The vulnerability was rated CVSS 3.0 Low 3.8 due to high attack complexity requiring...

SingleStore: Privilege Escalation – Access to the Alert Subscribers page for users with low privileges

A privilege escalation vulnerability was discovered in the SingleStore Helios alert management system. The vulnerability allowed users with low privileges to access the Alert Subscribers API endpoint and retrieve email addresses and alert severity level preferences of notification subscribers,...

U.S. Dept Of Defense: Cross-Site Scripting via URL on ███████

A Cross-Site Scripting XSS vulnerability was discovered on a website from the U.S. Department of Defense. The vulnerability was found in the GET method via the URL. Exploitation of this vulnerability could have led to the execution of malicious scripts. No further details about the vulnerability ...

U.S. Dept Of Defense: Publicly Accessible CDN Endpoint Exposing XML Metadata (including ETag)

A publicly accessible CDN endpoint was found that returned raw XML listing of stored objects, including metadata such as Key, LastModified, Size, StorageClass, and ETag. The ETag values, which can contain object hashes, were exposed publicly. This configuration allowed reconnaissance of the...