61616 matches found
CVE-2026-47660
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit oauthMetadataUrl parameter that is not validated against...
JLSEC-2026-1204 libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated...
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTPS request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid...
JLSEC-2026-1208 When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl...
When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances...
JLSEC-2026-1206
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. whil...
JLSEC-2026-1215 When asking curl to use a `.netrc` file to find credentials and at the same time specifying a URL...
When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no...
CVE-2026-47660 Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit oauthMetadataUrl parameter that is not validated against...
CVE-2026-47660
Pathling Server prior to 2.0.0 is affected: the bulk-submit flow accepts an explicit oauthMetadataUrl that is not validated against pathling.bulkSubmit.allowableSources. If provided, the OAuth flow trusts the metadata and the token_endpoint from the caller-chosen location, then builds outbound OA...
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
ClickFix-style attacks are being used to deliver a Go-based malware capable of stealing cryptocurrency assets, as well as browser-stored passwords, Apple iCloud Keychain data, and cached credentials. The macOS-focused infection chain is designed to deliver a shell script that profiles the host an...
MAL-2026-13628 Malicious code in streak-map-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...
MAL-2026-13519 Malicious code in streak-kit-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...
CVE-2026-54204
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...
CVE-2026-54205
Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...
CVE-2026-54207
Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...
EUVD-2026-54437
Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...
CVE-2026-49008
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...
CVE-2026-49006
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission...
CVE-2026-49007
By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...
CVE-2026-49008 Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...