CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7....

CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7....

CVE-2026-6616

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. I...

CVE-2026-10287

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function getheaders of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-10287

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function getheaders of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-10287 SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function getheaders of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-10287

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function getheaders of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-10287

The vulnerability affects SourceCodester SEO Meta Tag Extractor 1.0, specifically the get_headers function in /index.php. The issue arises from manipulating the url parameter, enabling server-side request forgery (SSRF) that can be initiated remotely. Exploit details have been publicly disclosed....

PT-2026-45552

Name of the Vulnerable Software and Affected Versions SourceCodester SEO Meta Tag Extractor version 1.0 Description An issue exists in the /index.php file where the get headers function does not properly validate the url argument. This allows a remote attacker to perform Server-Side Request Forge...

CVE-2026-10287: Server-Side Request Forgery (SSRF)

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function getheaders of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been...

acg-feature-extractor (0.0.2), aiographql-client (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2026-44660 via ujson (2.0.3)

ujson PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - acg-feature-extractor 0.0.2 - aiographql-client =1.0.0, =2.3.0, =3.7.1, =3.0.2, =3.7.0, =1.2.0, =0.9.20, =0.3.0, =1.0.0 and more Source cves:...

acg-feature-extractor (0.0.2), actscene-ocr (>=0.1.3, <=0.1.5) +464 more potentially affected by CVE-2026-44660 via ujson (>=1.33.0, <=5.12.0)

ujson PYPI version =1.33.0, =0.1.3, =0.1.0, =1.1.5, =2.0.1, =0.1.0, =0.1.1, =0.5.2, =0.1.0, =1.0.0a0, =0.1.1, =0.1.3, =0.1.0, =0.3.0 and more Source cves: CVE-2026-44660 Source advisory: MEND:CVE-2026-44660...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-R8CJ-3554-33MR...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-4671 via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-4671 Source advisory: OSV:GHSA-R8CJ-3554-33MR...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: GHSA-8JH2-3MW6-6PFM...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: OSV:GHSA-8JH2-3MW6-6PFM...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: SNYK:JS-NODETSOCR-16787371...

catalystcoop-ferc-xbrl-extractor (>=0.6.1, <=0.8.4), catalystcoop-pudl (>=2022.11.30, <=2022.11.30.post1) +1 more potentially affected by CVE-2026-42796 via arelle-release (>=2.2.4, <=2.11.12)

arelle-release PYPI version =2.2.4, =0.6.1, =2022.11.30, =0.6.1a0, =0.7.0 Source cves: CVE-2026-42796 Source advisory: SNYK:PYTHON-ARELLERELEASE-16635954...

catalystcoop-ferc-xbrl-extractor (>=0.6.1, <=0.8.4), catalystcoop-pudl (>=2022.11.30, <=2022.11.30.post1) +1 more potentially affected by CVE-2026-42796 via arelle-release (>=2.2.4, <=2.11.12)

arelle-release PYPI version =2.2.4, =0.6.1, =2022.11.30, =0.6.1a0, =0.7.0 Source cves: CVE-2026-42796 Source advisory: MEND:CVE-2026-42796...

JS Endpoint Extractor

Extract JS files and discover API endpoints/domains/keys from public client-side code. from kittysploit import import json import re from urllib.parse import urljoin, urlparse from lib.protocols.http.httpclient import Httpclient from lib.osint.jssecrets import extractsecrethints class...