better-auth-cloudflare (0.1.0), next-ai-draw-io (0.4.10) potentially affected by CVE-2026-100409 via @opennextjs/cloudflare (>=1.0.1, <=1.14.8)

@opennextjs/cloudflare NPM version =1.0.1, =1.14.8 is affected by a known vulnerability. The following packages have a transitive dependency on @opennextjs/cloudflare and may be impacted: - better-auth-cloudflare 0.1.0 - next-ai-draw-io 0.4.10 Source cves: CVE-2026-100409 Source advisory:...

PT-2026-115014

Name of the Vulnerable Software and Affected Versions OpenNext Cloudflare versions 0.3.0 through 1.20.1 Description Applications that enable enableCacheInterception and rely on middleware for access control are subject to inconsistent processing of encoded pathnames between middleware matching an...

CVE-2026-100409: Improper Handling of URL Encoding (Hex Encoding)

OpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on middleware for access control, and have a matching cached protected route process encoded pathnames inconsistently between middleware matching and cach...

CVE-2026-102354

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

CVE-2026-102354 BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

CVE-2026-102354

BentoPDF versions through 2.8.6 are vulnerable to a Server-Side Request Forgery (SSRF) via a Time-of-check Time-of-use (TOCTOU) race condition in the cloudflare/cors-proxy-worker.js component. The issue exists because hostnameResolvesToPrivate() performs a DNS-over-HTTPS safety check separately f...

EUVD-2026-101579

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

CVE-2026-102354

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

CVE-2026-102354 BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

CVE-2026-102354 BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

OpenNext for Cloudflare: Input validation error vulnerability

OpenNext for Cloudflare versions 0.3.0 to 1.20.2 have a security vulnerability. This vulnerability arises when enabling enableCacheInterception and relying on middleware for access control. The handling of encoded path names is inconsistent between middleware matching and cache lookup...

CVE-2026-102354: Time-of-check Time-of-use (TOCTOU) Race Condition

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

PT-2026-113936

BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate, as used by isValidCertificateUrl and isValidTsaUrl, separately from the outbound fetchtargetUrl,...

ghostbuster

Índice Índice Ghostbuster El problema Características del proyecto Instalación de Ghostbuster Uso de Ghostbuster Ejemplo de salida Configuración de tus cuentas AWS Configuración de Cloudflare Opcional Autores Licencia Ghostbuster Elimina IPs elásticas colgantes realizando análisis de tus recursos...

resolvers

Resolvers La lista più esaustiva di resolver DNS affidabili resolvers.txt: Una semplice lista di indirizzi IP dei resolver, che puoi passare direttamente al tuo strumento di enumerazione DNS. resolvers-extended.txt: Tutti i resolver presenti in resolvers.txt con informazioni aggiuntive su ciascun...

16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys. "The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recove...

Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

GHSA-Q333-F498-W2X7 Backstage: Insufficient audience validation in the Cloudflare Access auth provider

Impact The Cloudflare Access auth provider verifies a token's signature and team issuer, but affected versions do not verify that the token was issued for the Backstage application. A user holding a valid token for another Access application in the same Cloudflare Zero Trust team may therefore be...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...

@backstage/plugin-auth-backend (>=0.0.0-nightly-20250225023230, <=0.24.5), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20250225023230, <=0.4.2) +2 more potentially affected by CVE-2026-106457 via @backstage/plugin-auth-backend-module-cloudflare-access-provider (>=0.1.6-next.2, <=0.4.18)

@backstage/plugin-auth-backend-module-cloudflare-access-provider NPM version =0.1.6-next.2, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.0.0-nightly-20250225023230, =0.4.2 - @jiteshy/backstage-plugin-synergy-backend 1.2.2 Source cves: CVE-2026-106457 Source advisory:...