44078 matches found
CVE-2026-101438
The Siebel CRM Cloud Applications product by Oracle (specifically the Siebel Cloud Manager component) is affected by a vulnerability in versions 22.3-26.9 . An unauthenticated attacker with access to the physical communication segment attached to the hardware can exploit this high-complexity vuln...
CVE-2026-101436
A vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications (versions 22.3-26.9). A high-privileged attacker with logon access to the infrastructure can exploit this difficult-to-exploit vulnerability to compromise the application. Successful exploitation ...
GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...
spring-cloud__spring-cloud-gateway_CVE-2022-22947_3-0-6
//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-gateway/tree/master.svg?style=svg"CircleCI",...
Malicious code in research-probe-6150c1c915 (PyPI)
Source: kam193 a646eaf4fe72ba013abc53d52c0bf017a9c4f3bfc54a8c358f9f246d3ac41945 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a loca...
Malicious code in security-research-startup-snapshot-810764b303 (PyPI)
Source: kam193 c7f807a5943ac03cda3bdddc675ad3192d210e1f0ba1300959feff5d1d29c915 The package is most likely a reconnaissance of a shared infrastructure, collecting potentially sensitive data from cloud endpoints, activated via a PTH file on every Python loading. Collected data are stored in a loca...
CVE-2026-34160
CVE-2026-34160 — Unauthenticated SSRF in Chamilo LMS via PENS plugin pens.php Severity : High CVSS 8.6 CWE : CWE-918 Server-Side Request Forgery Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-g2xj-4cch-j276 NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-34160 Credit ...
CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...
CVE-2026-111761
The A2A Java SDK (prior to version 1.3.0.Final ) is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of destination validation, scheme restrictions, or redirect bounds in the BasePushNotificationSender component. An unauthenticated caller can register a destination via SendMessage o...
CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...
CVE-2022-22947-pb-ai
CVE-2022-22947 Spring Cloud Gateway Vulnerability Verification Application This is a Spring Cloud Gateway application specifically designed to demonstrate and verify the CVE-2022-22947 vulnerability. The application uses a vulnerable version of Spring Cloud Gateway and allows arbitrary code...
Spring-Cloud-Gateway-CVE-2022-22947
Spring-Cloud-Gateway-CVE-2022-22947 Spring-Cloud-Gateway-CVE-2022-22947...
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities...
CVE-2026-85267
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched...
CVE-2026-85267 Cross-Site WebSocket Hijacking in Google Cloud Shell
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched...
EUVD-2026-104858
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. This vulnerability was patched...
CVE-2026-85267
A Cross-Site WebSocket Hijacking vulnerability exists in Google Cloud Shell on Google Cloud Platform (prior to 2026-07-22). The root cause is missing origin validation in WebSockets (CWE-1385), which allows an unauthenticated attacker to hijack an active Cloud Shell session via a cross-origin Web...
domain-protect
OWASP Domain Protect - moved OWASP Domain Protect has moved to terraform-aws-domain-protect OWASP Domain Protect is now available as a Terraform Module See OWASP Domain Protect documentation including options for migration...