110 matches found
nuclei-templates
Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...
CVE-2026-44613: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...
CVE-2026-28201 SurrealDB Injection on Open Notebook
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...
CVE-2026-28201: Improper Input Validation
An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...
Permissive Cross-domain Policy with Untrusted Domains
Overview litestar is a Litestar - A production-ready, highly performant, extensible ASGI API Framework Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the CORSConfig.allowedoriginsregex, which uses a regex built from configured allowli...
CVE-2025-1102
A CWE-346 "Origin Validation Error" in the CORS configuration in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to affect the device confidentiality, integrity, or availability via crafted URLs or HTTP requests...
EUVD-2025-34775
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration...
EUVD-2019-0332
Malware in sbrugna...
EUVD-2020-8224
Malware in sbrugna...
EUVD-2021-1880
Malware in sbrugna...
EUVD-2021-26840
Malware in sbrugna...
EUVD-2018-0202
Malware in sbrugna...
EUVD-2023-2775
Malicious code in bioql PyPI...
EUVD-2025-7789
Malicious code in bioql PyPI...
EUVD-2025-14304
Malicious code in bioql PyPI...
EUVD-2025-7072
Malicious code in bioql PyPI...
EUVD-2023-1120
Malicious code in bioql PyPI...
EUVD-2023-2683
Malicious code in bioql PyPI...
EUVD-2021-28240
Malicious code in bioql PyPI...
CVE-2025-41010: Permissive Cross-domain Policy with Untrusted Domains
Incorrect Cross-Origin Resource Sharing CORS configuration in Hiberus Sintra. Cross-Origin Resource Sharing CORS allows browsers to make cross-domain requests in a controlled manner. This request has an “Origin” header that identifies the domain making the initial request and defines the protocol...