330606 matches found
EUVD-2026-70236
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...
CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...
CVE-2026-84377
LiteLLM (an AI Gateway/proxy server for LLM APIs) is affected by an authenticated SSRF and provider-credential exfiltration vulnerability prior to versions 1.88.6 and 1.96.2 . The root cause lies in incomplete request validation across multiple proxy files (auth_utils.py, common_request_processin...
CVE-2026-79756
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
EUVD-2026-70234
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter -r parameter, typically used to stream results and status of curation...
CVE-2026-49831 DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter -r parameter, typically used to stream results and status of curation...
CVE-2026-49831
CVE-2026-49831 is a Path Traversal vulnerability in the DSpace Curation Task feature. The curate script's reporter output path (-r parameter) is not restricted to a configured base directory, allowing any path writable by the DSpace (typically tomcat) user. An attacker with Collection/Community/S...
CVE-2026-49831 DSpace: Curation Task Reporter output path is not restricted to trusted directories (Path Traversal Vulnerability)
DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.7, 8.4, 9.3, and 10.0, the Curation Task feature allows an output path to be used by the reporter -r parameter, typically used to stream results and status of curation...
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
EUVD-2026-70219
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...
CVE-2026-79756
Nuclio is a serverless framework for real-time events and data processing. Prior to version 1.17.4 , an incomplete fix for unauthenticated OS command injection in the Nuclio dashboard on the local/Docker platform leaves the list-all resource path vulnerable: when no specific resource name is prov...
iron-proxy
iron-proxy El problema Los trabajos de CI, los agentes de codificación con IA y los contenedores en sandbox pueden realizar solicitudes salientes arbitrarias. Una dependencia comprometida, una inyección de prompt o un paso de compilación malicioso pueden exfiltrar secretos, comunicarse con el...
CVE-2026-84671
Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...
CVE-2026-84661
A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b67ea11b152 and earlier causes downstream builds awaited by the waitForBuild step when the propagateAbort parameter is used to be canceled even when the build's authentication lacks Item/Cancel permission on the downstream jo...
CVE-2026-84656
A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to...
infisical
The open-source secret management platform : Sync secrets/configs across your team/infrastructure and prevent secret leaks. Slack | Infisical Cloud | Self-Hosting | Docs | Website | Twitter | Hiring Remote/SF Introduction Infisical is the open source security infrastructure platform that teams us...
CVE-2025-27636-demo
Apache Camel CVE Demonstration This project demonstrates security vulnerabilities in Apache Camel related to header injection attacks. Docker Build Build the Docker image: root@kitploit: docker build -t camel-cve-demo . Docker Run Run the container with all necessary ports: root@kitploit: docker...
cve-2026-33067
CVE-2026-33017 — Langflow Unauthenticated RCE Nuclei Template Nuclei template that detects CVE-2026-33017 — an unauthenticated remote-code-execution vulnerability in Langflow ≤ 1.8.2 reachable through the public flow-build endpoint: root@kitploit: POST /api/v1/buildpublictmp/flowid/flow The...