Himmelblau 安全漏洞

Himmelblau is an open-source Azure Entra ID authentication module developed by Himmelblau. Versions of Himmelblau from 2.0.0 to 3.1.5, as well as versions prior to 2.3.11, contained security vulnerabilities. These vulnerabilities stemmed from the tokenvalidate function, which did not verify wheth...

ALPINE-CVE-2026-42959

NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets fo...

EUVD-2026-8685

esm.sh has SSRF localhost/private-network bypass in /https module route...

GHSA-P2V6-84H2-5X4R esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

Summary An SSRF vulnerability CWE-918 exists in esm.sh’s /https fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains for example, 127.0.0.1.nip.io resolving to 127.0.0.1. This allows a...

CVE-2026-27730

esm.sh is a no-build content delivery network CDN for web development. Versions up to and including 137 have an SSRF vulnerability CWE-918 in esm.sh’s /https fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypass...

EUVD-2005-3908

Malware in sbrugna...

FAQ: XenMobile Derived Credentials

What are Derived Credentials? Derived credentials provide strong authentication for mobile devices. The credentials, derived from a smart card, reside in a mobile device instead of the card. The smart card is either a Personal Identity Verification PIV card or Common Access Card CAC. The derived...

nginx: Insufficient limits of CNAME resolution in resolver

It was discovered that nginx did not limit recursion when resolving CNAME DNS records. An attacker able to manipulate DNS responses received by nginx could use this flaw to cause a worker process to use an excessive amount of resources if nginx enabled the resolver in its configuration...

CVE-2005-3913

Unspecified vulnerability in the domain alias management in Virtual Hosting Control System VHCS 2.4.6.2, related to "creating and deleting forwards for domain aliases," allows users to hijack the forwardings of other users...

CVE-2005-3913

The CVE-2005-3913 entry concerns VHCS (Virtual Hosting Control System) 2.4.6.2. The vulnerability affects the domain alias management feature, specifically the creation and deletion of forwards for domain aliases, which enables a user to hijack the forwardings of other users. The provided sources...

CVE-2005-3913: Undefined Security Weakness

Unspecified vulnerability in the domain alias management in Virtual Hosting Control System VHCS 2.4.6.2, related to "creating and deleting forwards for domain aliases," allows users to hijack the forwardings of other users...