293 matches found
CVE-2025-65855
CVE-2025-65855 HelpFlash IoT OTA Update Multiple Vulnerabilities Summary Multiple vulnerabilities in the OTA firmware update mechanism of Netun Solutions HelpFlash IoT allow an attacker with brief physical access to execute arbitrary code. CVE ID: CVE-2025-65855 Severity: HIGH CVSS v3.1 Score: 7....
GHSA-JJ7H-C3HG-M23X Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...
Malicious code in @ppa-web-components/ppa-banner (npm)
Source: amazon-inspector bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d @ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and beacon.cjs. beacon.cjs defines BEACON =...
Malicious code in @ppa-web-components/ppa-hotel-collection (npm)
@ppa-web-components/ppa-hotel-collection is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.1.0, 1.0.0, 99.0.1, 2.0.1, 3.0.0 has a postinstall script...
Malicious code in @ecg-internal/media-util-js-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...
MAL-2026-18210 Malicious code in @ecg-internal/media-util-js-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...
CVE-2026-114614
The Authlib Python library (versions 0.13 through 1.8.0 ) is vulnerable due to a flaw in authlib.common.security.is_secure_transport() . The function uses a textual prefix comparison for loopback HTTP exemptions, which can be exploited if a URL's userinfo component begins with a loopback host whi...
CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...
CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...
Malicious code in css-svqggc-polyfill (npm)
Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, and other namespace stubs, with a...
MAL-2026-17557 Malicious code in css-svqggc-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry,...
CVE-2026-102670
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...
CVE-2026-14984 Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...
CVE-2026-14984 Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...
EUVD-2026-91029
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...
CVE-2026-102670
The Joyland AI app is vulnerable because it explicitly permits cleartext HTTP traffic on devices running Android 9+ . This configuration deviates from the platform's default security behavior, which is to block such traffic, potentially exposing sensitive information during transmission. No speci...
CVE-2026-102670 Joyland AI enables HTTP
Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it...
