Follow-redirects input validation vulnerability

The follow-redirects version 1.16.0 to 1.16.1 had a security vulnerability. This vulnerability stemmed from escapeRegex not escaping the regular expression metacharacters in the sensitiveHeaders. When sensitive header names contained ^ or |, and during cross-domain or HTTPS-to-HTTP redirection, t...

Sunkaifei FlyCms Trust Management Vulnerability

Sunkaifei FlyCms has a vulnerability related to trust management. This vulnerability arises from the use of default credentials. An attacker can exploit the FlyCms account and password “admin123” to log in by simply completing a graphical verification code. This allows them to obtain super...

MISP information leakage vulnerability

Versions of MISP 2.5.48 and earlier contain a security vulnerability. This vulnerability arises from the server discarding the redacted and clionly flags specified in the module configuration during the rebuilding process. This could allow authenticated users who have access to the server setting...

CrewAI AMP Suite server-side request forgeing vulnerability

CrewAI AMP Suite versions 1.15.28 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from the fact that the SeleniumScrapingTool does not apply the validateurl private address checking, making it vulnerable to server-side request forgeing attacks. Attackers ca...

Apache Camel server-side request forge vulnerability

Versions of Apache Camel prior to 4.18.5, specifically 4.0.0 and 4.22.1 prior to 4.19.0, have a server-side request forge vulnerability. This vulnerability stems from the camel-as2 component extracting the asynchronous MDN return address from inbound messages and using it directly as the outbound...

Eptura archibus information leakage vulnerability

Versions of Eptura Archibus prior to 2025.02 contained an information leakage vulnerability. This vulnerability stemmed from sending DWR requests with specified workflow rules, which allowed access to detailed database information such as usernames and passwords. Combined with authentication bypa...

Craft CMS Information Disclosure Vulnerability

Craft CMS contains an information disclosure vulnerability stemming from a bypass of the Twig sandbox allowlist. the column, contains, filterByValue, index, where, and multisort filters do not adhere to the sandbox security policy when parsing keys provided by the caller via ArrayHelper::getValue...

Apache Answer log information disclosure vulnerability

Apache Answer versions 2.0.2 and earlier contain a vulnerability related to log information leakage. This vulnerability arises from writing sensitive information to log files; each authentication request writes the full API key into the application logs. As a result, individuals with log reading...

Apache Camel information leakage vulnerability

Apache Camel HTTP versions from 4.0.0 to 4.18.5, as well as versions from 4.19.0 to 4.22.1, have a vulnerability related to information leakage. This vulnerability arises when the followRedirects=true parameter is used, and the OAuth2ClientConfigurer interceptor intercepts and matches AuthScope f...

D-Link E15 Trust Management Vulnerability

D-Link E15, M32, R15, and R32 have vulnerabilities related to trust management. These vulnerabilities stem from the MQTT Broker component’s improper handling of the file /etc/emDaemon/passwd, which results in hardcoded credentials. These vulnerabilities could be exploited remotely...

WSO2 Universal Gateway encryption vulnerabilities

WSO2 Universal Gateway versions from 4.5.0 through 4.5.0.46 and from 4.6.0 through 4.6.0.14, WSO2 Traffic Manager versions from 4.5.0 through 4.5.0.45 and from 4.6.0 through 4.6.0.14, WSO2 API Control Plane versions from 4.5.0 through 4.5.0.47 and from 4.6.0 through 4.6.0.15, WSO2 API Manager...

Apache Camel configuration error vulnerability

Versions of Apache Camel from 4.0.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a configuration error vulnerability. This vulnerability stems from the enableCORS function of the Jetty component using the default CrossOriginFilter configuration, which accepts requests from any origin and allows...

CVE-2026-111998

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...

CVE-2026-111998

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...

EUVD-2026-103451

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...

CLSA-2023-1686651204 kernel: Fix of 28 CVEs

cgroup: Use open-time cgroup namespace for process migration perm checks CVE-2021-4197 - cgroup: Use open-time credentials for process migraton perm checks CVE-2021-4197 - vt: drop old FONT ioctls CVE-2021-33656 - fbmem: Check virtual screen sizes in fbsetvar CVE-2021-33655 - fbcon: Prevent that...

Malicious code in leakdeep (PyPI)

Source: amazon-inspector c0818f9da5e7dc1413ff1b2a24d3cb53d0b49d06bd802502296d6d8e8e536fee The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub returning an empty list. Every invocation of the CLI...

MAL-2026-17921 Malicious code in leakdeep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0818f9da5e7dc1413ff1b2a24d3cb53d0b49d06bd802502296d6d8e8e536fee The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub...

Malicious code in leakdeep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0818f9da5e7dc1413ff1b2a24d3cb53d0b49d06bd802502296d6d8e8e536fee The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub...

CVE-2026-111998: Use of Default Credentials

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users,...