1803 matches found
Malicious code in pullgetsage (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b751049f78b324983511537b6c053a0ed080639dd7c447d87494eabc134ba3 On import, init.py archives the installer's Telegram Desktop tdata directory %APPDATA%/Telegram Desktop/tdata into a zip named 'aiosendletterlogs' an...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in cloudflare/cfSSL
Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package cloudflare/cfSSL that is affected by a medium-severity vulnerability. IBM Optim 2.0.0 resolves this vulnerability by removing the affected dependency. Vulnerability Details CVEID:CVE-2021-34558 DESCRIPTION: The...
CVE-2026-54649
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...
CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...
EUVD-2026-82386
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...
CVE-2026-54649
punchin-email is a Cloudflare Email Worker providing two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0 , the handleInbound handler delivers inbound alias mail via message.forward(), which silently drops the Reply-To header intended to route responses through the relay. W...
CVE-2026-54649 punchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...
CVE-2026-54649: Exposure of Sensitive Information to an Unauthorized Actor
punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward, which silently drops the added Reply-To header intended to route responses through the relay. When ...
pingap v0.14.2
pingap Before the pingap version is stable, no pull requests will be accepted. If you have any questions, please create a new issue first. Overview Pingap is a high-performance reverse proxy powered by the Cloudflare Pingora . It simplifies operational management by enabling dynamic, zero-downtim...
waf-checker v1.2.0
WAF Checker This project helps you check how well your Web Application Firewall WAF protects your product against common web attacks. It can be run as a Cloudflare Worker with a built-in interactive Web UI or as a standalone Node.js CLI tool. Features Core Testing Enter a target URL, pick HTTP...
MAL-2026-16140 Malicious code in tracker-cloudflare (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...
CVE-2026-85116
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-85116 Simple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-85116
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin (versions 1.2.2 before 1.42.3) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that the plugin's shortcode parser runs over the entire rendered Contact Form 7 form, including values a visitor submitte...
CVE-2026-85116: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...
CVE-2026-66674
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...
CVE-2026-66632
Unauthenticated Content Injection in Simple Cloudflare Turnstile = 1.42.1 versions...
EUVD-2026-75512
Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile = 1.42.1 versions...