CVE-2026-114062 SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server,...

Linux Distros Unpatched Vulnerability : CVE-2026-109351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge...

PT-2026-120188

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server,...

Linux Distros Unpatched Vulnerability : CVE-2026-109349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::newfromheader: the pack header decoder accepts version 3, but a...

Linux Distros Unpatched Vulnerability : CVE-2026-109350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack...

CVE-2026-113728

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An...

CVE-2025-8110-PoC

CVE-2025-8110 PoC Python proof-of-concept script for CVE-2025-8110 — Gogs v0.13.3 UpdateRepoFile symlink RCE. Single-shot: the malicious PUT itself triggers git fetch → sshCommand → reverse shell. ⚠️ For educational and authorized security research only. Running this tool against systems you do no...

CVE-2026-113728

Versions of Bulwark Webmail prior to 1.9.2 are vulnerable to a DNS-rebinding SSRF in the public POST /api/fetch-ical endpoint. The root cause is a check-then-fetch pattern where the application performs one DNS lookup for validation and a second lookup for the socket connection; an attacker contr...

Malicious code in semvver (PyPI)

Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes the response to a temporary path, and spawns it ...

MAL-2026-18104 Malicious code in semvver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyup...

Malicious code in semvver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbc16b0ced0bad1a33b912dfdb29cbaef211f30974d942991257d4e6b60a8ece setup.py performs an install-time fetch-and-execute: it calls urllib.request.urlretrieve against https://c2-worker.crawlnet-claim.workers.dev/dl/pyup...

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

Summary The @apostrophecms/ai-helper package builds the URL for a server-side image fetch by resolving a storage-relative path against req.baseUrl. When the site does not set a global base URL the default, req.baseUrl is derived from the incoming HTTP Host header. An authenticated editor can...

CVE-2026-113671

In ApostropheCMS , a vulnerability exists in the @apostrophecms/ai-helper component (versions 1.0.0-beta.10 through 1.0.0-beta.13 ). An authenticated editor with image-generation capabilities can create a base64-generated image record without a provider URL. On deployments using local relative st...

CVE-2026-113671 ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local...

halo-cve-2026-67919

halo plugin rce from a url halo's console lets admins install and upgrade plugins by pasting a url. it fetches whatever url, installs the jar, and the jar's code runs on the server. no scheme checks, no host checks, redirects followed, and the plugin manager loads the extension classes straight o...

CVE-2026-21636

CVE-2026-21636 - Node.js Permission Model UDS/Network Bypass Vulnerability summary The Node.js permission model --permission is designed to sandbox a process by restricting access to the filesystem, child processes, workers, and network. CVE-2026-21636 reveals that connections made via undici/fet...

Triple_fetch

triplefetch - ianbeer https://bugs.chromium.org/p/project-zero/issues/detail?id=1247 This is an exploit for CVE-2017-7047, a logic error in libxpc which allowed malicious message senders to send xpcdata objects that were backed by shared memory. Consumers of xpc messages did not seem to expect th...

CVE-2019-9849

CVE-2019-9849: Remote bullet graphics retrieved in “stealth mode” in LibreOffice LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable...

anubis-fetch

anubis-fetch $ nix run github:fzakaria/anubis-fetch -- --text https://lore.kernel.org/ A Go CLI for fetching URLs behind Anubis proof-of-work challenges. It solves legacy SHA-256 and WASM challenges in-process, with headless Chromium as a fallback. Sites such as lore.kernel.org and kernel.org use...

CVE-2026-112076

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...