CVE-2022-22963

CVE-2022-22963 Remote Code Execution exploiting CVE-2022-22963 attacking Spring Cloud service. Disclamier: This is for educational purposes only. The author is not responsible for the use of this program. Use under your own risk Usage ./CVE-2022-22963 -h Usage: CVE-2022-22963 OPTIONS Application...

CVE-2026-115729

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, ::, NAT64 or localhost alias hostnames to read loopback, internal o...

CVE-2026-115752 Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud...

CVE-2026-115752

The Signal K Server (versions 2.28.0-beta.2 before 2.34.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) in its App Store icon fetcher. The root cause is that the fetcher trusts absolute signalk.appIcon URLs. This allows attackers who publish npm packages containing Signal K keywords to ...

CVE-2026-115729 @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, ::, NAT64 or localhost alias hostnames to read loopback, internal o...

CVE-2026-115729 @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, ::, NAT64 or localhost alias hostnames to read loopback, internal o...

CVE-2026-115729

@pdfme/common versions 5.5.10 before 6.2.6 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the getB64BasePdf function. The root cause is a bypass of the isUrlSafeToFetch denylist, which allows attackers to provide URLs using IPv4-mapped IPv6 , [::] , NAT64 , or localho...

CVE-2022-22947

CVE-2022-22947 A code injection attack on spring cloud gateway Summary of the CVE In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make ...

spring-cloud-netflix-hystrix-dashboard-cve-2021-22053

CVE-2021-22053: Spring Cloud Netflix Hystrix Dashboard template resolution vulnerability Severity High Vendor Spring by VMware Description Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI...

lightwave

What is Lightwave Project Lightwave is an open source project comprised of enterprise-grade, identity and access management services targeting critical security, governance, and compliance challenges for Cloud-Native Apps within the enterprise. Through integration with Project Photon, Project...

opencspm

OpenCSPM Open Cloud Security Posture Management, OpenCSPM, is an open-source platform for gaining deeper insight into your cloud configuration and metadata to help understand and reduce risk over time. Who is OpenCSPM for? Security teams running infrastructure in cloud environments looking to gai...

Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker can send a request using a specially...

CVE-2026-114620

A flaw was found in Authlib. A remote attacker can trigger Server-Side Request Forgery SSRF by submitting an unvalidated request URI parameter in an authorization request. Because the library forwards client-supplied addresses to internal retrieval handlers without enforcing destination policies ...

Alibaba Cloud Linux 3 : 0319: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2026:0319)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0319 advisory. Package updates are available for Alibaba Cloud Linux 3 Pro that fix the following vulnerabilities: CVE-2026-99999: In the Linux kernel, the...

Alibaba Cloud Linux 3 : 0320: kernel (ALINUX3-SA-2026:0320)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0320 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-99999: In the Linux kernel, the following...

Alibaba Cloud Linux 3 : 0318: php (ALINUX3-SA-2026:0318)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0318 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-1218: The mysqlnd wire protocol...

ASPM in the AI Era Part 2: Prioritize Exploitable Risks with Code-to-Cloud Context

Reduce triage times and focus on the risks that matter most by combining context across code, infrastructure, and runtime...

Security Bulletin: watsonx.ai on Cloud Pak for Data is vulnerable to Uncontrolled Resource Consumption due to netty-codec-http2-4.1.72.Final (CVE-2023-44487)

Summary netty-codec-http2 is used by watsonx.ai on Cloud Pak for Data for its Watson Document Understanding runtime component Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

riskscanner

Open source multi-cloud security compliance scanning platform Chinese Version RiskScanner is an open source multi-cloud security compliance scanning platform, Based on Cloud Custodian、Prowler and Nuclei engines, it realizes security compliance scanning and vulnerability scanning of mainstream...