CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

EUVD-2026-62506

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792 Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792

Algernon (a pure-Go web server) prior to 1.17.9 is vulnerable to server-side script source disclosure on Windows via NTFS filename aliasing. The root cause is in engine/handlers.go: filepath.Ext() does not recognize NTFS-equivalent suffixes (::$DATA, trailing dot, trailing space) as the script ex...

Exploit for CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary Fi...

CVE-2026-76239

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-50720

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

CVE-2026-76239 Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76239 Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76239

Stigmem versions before 0.9.0a11 do not validate the delivery_address parameter in webhook subscription creation, enabling authenticated users to force the server to send POST requests to internal services (loopback/private network), achieving blind SSRF. Remediation: upgrade to 0.9.0a11 or later...

EUVD-2026-62403

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76239 Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

Cybermes

🛡️ Cybermes Autonomous Offensive Security, Bug Bounty &...

OASAS

OASAS - Offensive Automation & Scope-Aware Suite Very p...

Exploit for Deserialization of Untrusted Data in Apache Activemq

CVE-2023-46604 – Apache ActiveMQ Remote Code Execution Ove...

MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

SummaryThe findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path.An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitrary...

PYSEC-2026-3689 MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads

Summary The findiconpathzip function in MobSF does not properly sanitize the android:icon attribute extracted from an Android manifest before resolving it as a filesystem path. An attacker can supply a malicious android:icon value containing path traversal sequences, causing MobSF to read arbitra...

PYSEC-2026-3684 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

SummaryThe /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...

PYSEC-2026-3659 compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Summary compliance-trestle 4.0.3 latest ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent...