CVE-2025-8723

⚡️ Cloudflare Image Resizing Description: The plugin's REST API endpoint fails to authenticate users and improperly sanitizes input in the hookrestpredispatch method. This flaw enables attackers to inject and execute arbitrary PHP code by crafting malicious requests — with no login required. 🛠...

Security Bulletin: Impacted IBM Optim for z/OS 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in jackc/Pgx, cloudflare/cfSSL, x/net

Summary IBM Optim for z/OS version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages jackc/Pgx, cloudflare/cfSSL and x/net which are affected by medium, high and critical severity vulnerabilities. IBM Optim for z/OS 2.0.0 resolves these vulnerabilities by upgrading the affected open-source...

CVE-2023-6289

CVE-2023-6289 Swift Performance Lite = 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export Description The Swift Performance Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the on functionality hooked via admininit functi...

CVE-2025-58179-Check

CVE-2025-58179-Check CVE-2025-58179-Check is a simple Python script to verify SSRF Server-Side Request Forgery / Content Spoofing vulnerability on the /image endpoint in the Astro framework. This vulnerability is tracked as GHSA-qpr4-c339-7vq8 and CVE-2025-58179. Vulnerability Background This...

area51

Every callback, captured. The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a dashboard you control, and it gets whatever response you choose in return. Getting started · Playbooks · CLI · Architecture ·...

Linux Distros Unpatched Vulnerability : CVE-2026-91187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary...

EUVD-2026-86161

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-77581

BentoPDF, a self-hostable client-side PDF toolkit, contains a Server-Side Request Forgery (SSRF) vulnerability in the cloud/cors-proxy-worker.js component (versions 2.8.6 and earlier ). The root cause is a DNS-based hostname allowlist bypass where the isPrivateOrReservedHost() function validates ...

EUVD-2026-86229

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost to validate a supplied hostname separately from the DNS resolution used by fetchtargetUrl, allowing an...

CVE-2026-91187

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-91187

The dashbit nimble_zta library (versions 0.1.2 before 0.1.3 ) contains an improper verification of cryptographic signature vulnerability. Specifically, the verify_token/2 function in lib/nimble_zta/cloudflare.ex calls JOSE.JWT.verify/2 but fails to check the boolean verification result, returning...

CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

EUVD-2026-85871

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

EEF-CVE-2026-91187 Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

Summary Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

CVE-2026-91187: Improper Verification of Cryptographic Signature

Improper Verification of Cryptographic Signature vulnerability in dashbit nimblezta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verifytoken/2 in...

PT-2026-97797

Name of the Vulnerable Software and Affected Versions nimble zta versions 0.1.2 through 0.1.2 Description Improper verification of cryptographic signatures in the Cloudflare Zero Trust authentication strategy allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare...

CVE-2026-77581: Server-Side Request Forgery (SSRF)

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost to validate a supplied hostname separately from the DNS resolution used by fetchtargetUrl, allowing an...

PT-2026-97861

Name of the Vulnerable Software and Affected Versions BentoPDF versions prior to 2.8.7 Description The certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses the isPrivateOrReservedHost function to validate a supplied hostname separately from the DNS resolution used by...