6096 matches found
CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...
CVE-2026-52744
The GoCD continuous delivery server versions 20.2.0 through 26.1.0 is vulnerable to an authorization bypass in the internal UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream. Due to inadequate authorization of upstream dependency data, an authenticated user can retri...
CVE-2026-96757
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...
CVE-2026-96757
The orval library, in versions before 8.29.0 , is vulnerable to a code injection flaw due to the failure to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. An attacker can exploit this by providing a crafted media-type key in an...
CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...
CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...
MAL-2026-16422 Malicious code in @httttt/mcp-npx-fetch-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73432c5cbb8e74b1a4b66e91fdbde0eda311176dbef0301b13605d75bdd299ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2026-97433
Name of the Vulnerable Software and Affected Versions GoCD versions 20.2.0 through 26.0.x Description An authorization flaw exists in the internal UI fetch-artifact auto-suggestion API at the endpoint '/go/api/internal/pipelines//upstream'. An authenticated user can exploit this to retrieve...
CVE-2026-96757: Improper Control of Generation of Code
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...
CVE-2026-52744: Missing Authorization
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the absence of a total timeout in the remote policy fetch process. An attacker can cause the application to hang indefinitely by making a server respond extremely slowly, there...
CVE-2026-91867
Apache Neethi is vulnerable to a denial of service (DoS) condition because it lacks a total timeout when fetching remote policy references. While the system limits time per read, a malicious or slow server can trickle bytes slowly to keep the fetch alive indefinitely, tying up the calling thread....
CVE-2026-91867 Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread denial of service. Users are recommended to upgrade to version 3.2.4, which fixes thi...
BIT-ENVOY-GATEWAY-2026-53714 Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor bu...
MAL-2026-16340 Malicious code in pf25262 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95274790fd43042ecd1fc97b2c01dc194e863809626cdaee5c7e6b0a411f8aeb index.js contains a browser exfiltration snippet that issues a credentialed fetch to /profile, extracts a DGA... token or falls back to capturing...
PT-2026-95929
Name of the Vulnerable Software and Affected Versions Meow Gallery versions prior to 5.5.5 Description Insufficient capability checks in the fetch posts function allow authenticated users with Author-level access or higher to access post data that should be restricted. This flaw enables the...
CVE-2026-90984
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...
EUVD-2026-82683
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...
CVE-2026-54565
rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...
