45068 matches found
CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...
CVE-2026-65056
CVE-2026-65056 describes a server-side request forgery in mcp-webresearch 0.1.7. The vulnerability arises because visit_page validates only URL protocol and does not filter private or reserved IP ranges, enabling an attacker to access internal network services by supplying loopback, link-local, o...
EUVD-2026-46410
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...
AZL-93147 CVE-2026-56852 affecting package cloud-provider-kubevirt for versions less than 0.5.1-6
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
AZL-93219 CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
sysreptor v2026.58
An easy and customizable pentest reporting platform designed to simplify pentest report creation for security professionals. Playground • Ideas • Questions • Documentation • Features and Pricing • Installation • Buy SysReptor SysReptor is a fully customizable pentest reporting platform designed f...
galaxy (>=26.0.0, <=26.0.1), great-expectations-cloud (>=20260123.0.0.dev3, <=20260126.1.0.dev0) +2 more potentially affected by CVE-2026-59890 via setuptools (80.10.1)
setuptools PYPI version 80.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - galaxy =26.0.0, =20260123.0.0.dev3, =20260126.1.0.dev0 - netbox-manager 0.20260123.0 - water-column-sonar-processing 26.1.17 Source cves:...
great-expectations-cloud (20250515.0.0) potentially affected by CVE-2026-59890 via setuptools (80.7.0)
setuptools PYPI version 80.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - great-expectations-cloud 20250515.0.0 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...
cloud-misconfig-lab
Cloud Misconfiguration Exploitation Lab !AWShttps://img.s...
Malicious code in wisecloudcyberark (PyPI)
Source: kam193 f0e320bedb4902833dec6f929dff31967c3d37ce699cb0ed5bc586f36f36b25e During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well a...
Malicious code in wisecloudsecrets (PyPI)
Source: kam193 e4ed4357b3e8038ef404e043cc63aafe6484b20d94267c4f024a27d840a4a2fc During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment variables and cloud tokens to a hardcoded location, as well a...
Malicious code in veriftest1asdlaaa (PyPI)
Source: kam193 8ca63296b7d7f9b656944bcaf65cc918b709a2071d1ea5f16d1a7422a9df931e During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...
Malicious code in veriftest1asdla (PyPI)
Source: kam193 e04795c3a8f7fae13a125bde307aa64db04ae9f4ff76bd1d11fb32b4d3f57a36 During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...
Malicious code in veriftest1asdlaaaa (PyPI)
Source: kam193 18d30d48c72a61cda2e8b0ecd3a27b958e8964b4c65833cb780186382285101d During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...
Malicious code in veriftest1asdlaa (PyPI)
Source: kam193 84fe70a8f5e34c8334d7284bcc9b71826210f029708a53a6ec4b9bb90a33054b During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...
Malicious code in veriftest1asdl (PyPI)
Source: kam193 e11e583c94e6aea422cd70561ea53212b4b4a26dd4bcb2e42c4c1ad25066474d During installation, the package attempts to exfiltrate cloud tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-05-veriftest1asdl Reasons based on the...
Malicious code in timekeeper-verifier (PyPI)
Source: kam193 3a20fe9fed2445d097ddfd628d59e1b8149913aec4915c112cacfa9fb7cdfc6e This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...
Malicious code in tinkoff-cloud-apis-internal (PyPI)
Source: kam193 30caca1d5e67322644a0eb6cf8098151d975415baab826d14a0bba75117ae95e Package presents little functionality, but excessive fake 'telemetry' module. This fake telemetry is used to download and run malicious executables. Code is designed to survive different blocks: first, there is an...
Malicious code in time-server-analyzer (PyPI)
Source: kam193 95abdeda4b05cb93bb442d77d1b339498503b1fddb72e3579359f39c5952513b This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...