CVE-2026-10287: Server-Side Request Forgery (SSRF)

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function getheaders of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-45552

Name of the Vulnerable Software and Affected Versions SourceCodester SEO Meta Tag Extractor version 1.0 Description An issue exists in the /index.php file where the get headers function does not properly validate the url argument. This allows a remote attacker to perform Server-Side Request Forge...

acg-feature-extractor (0.0.2), aiographql-client (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2026-44660 via ujson (2.0.3)

ujson PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - acg-feature-extractor 0.0.2 - aiographql-client =1.0.0, =2.3.0, =3.7.1, =3.0.2, =3.7.0, =1.2.0, =0.9.20, =0.3.0, =1.0.0 and more Source cves:...

acg-feature-extractor (0.0.2), actscene-ocr (>=0.1.3, <=0.1.5) +463 more potentially affected by CVE-2026-44660 via ujson (>=1.33.0, <=5.12.0)

ujson PYPI version =1.33.0, =0.1.3, =0.1.0, =1.1.5, =2.0.1, =0.1.0, =0.1.1, =0.5.2, =0.1.0, =1.0.0a0, =0.1.1, =0.1.3, =0.1.0, =0.3.0 and more Source cves: CVE-2026-44660 Source advisory: MEND:CVE-2026-44660...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-4671 via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-4671 Source advisory: OSV:GHSA-R8CJ-3554-33MR...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-R8CJ-3554-33MR...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: OSV:GHSA-8JH2-3MW6-6PFM...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: GHSA-8JH2-3MW6-6PFM...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: SNYK:JS-NODETSOCR-16787371...

catalystcoop-ferc-xbrl-extractor (>=0.6.1, <=0.8.4), catalystcoop-pudl (>=2022.11.30, <=2022.11.30.post1) +1 more potentially affected by CVE-2026-42796 via arelle-release (>=2.2.4, <=2.11.12)

arelle-release PYPI version =2.2.4, =0.6.1, =2022.11.30, =0.6.1a0, =0.7.0 Source cves: CVE-2026-42796 Source advisory: SNYK:PYTHON-ARELLERELEASE-16635954...

catalystcoop-ferc-xbrl-extractor (>=0.6.1, <=0.8.4), catalystcoop-pudl (>=2022.11.30, <=2022.11.30.post1) +1 more potentially affected by CVE-2026-42796 via arelle-release (>=2.2.4, <=2.11.12)

arelle-release PYPI version =2.2.4, =0.6.1, =2022.11.30, =0.6.1a0, =0.7.0 Source cves: CVE-2026-42796 Source advisory: MEND:CVE-2026-42796...

JS Endpoint Extractor

Extract JS files and discover API endpoints/domains/keys from public client-side code. from kittysploit import import json import re from urllib.parse import urljoin, urlparse from lib.protocols.http.httpclient import Httpclient from lib.osint.jssecrets import extractsecrethints class...

Certificate Impersonation

spring-security-web is vulnerable to certificate impersonation. The vulnerability is due to improper parsing of malformed X.509 certificate CN values in SubjectX500PrincipalExtractor, which can result in extracting an incorrect username and allow attackers to impersonate another user...

CVE-2026-22747

A flaw was found in Spring Security. This vulnerability allows a remote attacker to impersonate another user. The SubjectX500PrincipalExtractor component incorrectly handles certain malformed X.509 certificate Common Name CN values, which can lead to the system reading an incorrect username. By...

chromewhip (>=0.3.0, <=0.3.4), gerapy-auto-extractor (>=0.0.1a1, <=0.1.2) +11 more potentially affected by CVE-2026-41066 via lxml (4.3.3)

lxml PYPI version 4.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - chromewhip =0.3.0, =0.0.1a1, =0.0.2, =1.2.2, =2019.5.24, =0.0.1, =1.3.7, =0.7.0, =0.1.0a1.dev1, =0.1.0a1.dev2 - spam 0.3.3 Source cves: CVE-2026-41066...

EUVD-2026-24609

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...

CVE-2026-22747 Unauthorized User Impersonation when Using X.509 Client Certificates

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...

Spring Security security vulnerabilities

Spring Security is a security framework developed by Spring OpenSource that includes authentication and authorization features. Versions of Spring Security 7.0.4 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the improper handling of certain malformed X.509...

OpenBao security vulnerabilities

OpenBao is an open-source sensitive data management software developed by OpenBao. Versions of OpenBao prior to 2.5.3 contained security vulnerabilities. These vulnerabilities stemmed from the ExtractPluginFromImage function in the OCI plugin downloader, which did not limit the number of bytes...

Directory Traversal

Overview com.github.junrar:junrar is a rar decompression library in plain java. Affected versions of this package are vulnerable to Directory Traversal via the LocalFolderExtractor component. An attacker can overwrite files in sibling directories by tricking a user into extracting a specially...