45729 matches found
CVE-2026-6790
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...
CVE-2026-6790
In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. This was not enforced in earlier HTTP RFC for example, in RFC 2616, but it is in the latest RFC 9110 and 9112. This...
BIT-COMPOSER-2026-59946 Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a world-readable and...
API Key Bypass
9Router is vulnerable to API key bypass. The vulnerability is due to the router determining whether a /v1 LLM proxy request is local by reading the client-controlled Host header, where a remote unauthenticated attacker can send Host: localhost and bypass API-key authentication, and this allows th...
EUVD-2026-43639
In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...
MAL-2026-10570 Malicious code in valid-scope (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8258d9b773ebc2f93cfb302421cba0c6047d258bb44355ec9ecd71ce74d2f90d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10563 Malicious code in humanize-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 602dcf2b61d28dfcdb2a5e3d0193b27f087d7e1c1714eed7d6f16c5a495d12cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10550 Malicious code in better-tailwindcss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...
Malicious code in better-tailwindcss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...
MAL-2026-10538 Malicious code in neteller (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c Package name and description impersonate the Paysafe-owned Neteller payment brand, with a fake repository URL 'github.com/paysafe/neteller'. The...
MAL-2026-10544 Malicious code in skrill-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...
Incomplete List of Disallowed Inputs
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper filtering of environment variables in the host exec process. An attacker can gain unauthorized access or perform actions beyond their...
Incomplete List of Disallowed Inputs
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the host exec environment filtering process. An attacker can gain unauthorized access and execute or persist actions beyond their intended...
EUVD-2026-43540
OpenClaw versions before 2026.6.1 contain a flaw in host exec environment filtering that could allow Git ext transport to be abused. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended...
EUVD-2026-43539
OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions...
EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-2644)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent...
PT-2026-58134
Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description A heap-based buffer overflow exists in Windows DHCP Server, which allows an authorized attacker to execute arbitrary code over a network. A heap-based buffer overflow occurs when ...
host-metering security update
1.2.0-4.0.1 - Rebuild with new go-toolset-1.19-golang to fix CVE-2026-32283 Orabug: 39352233...
Security Update for Microsoft ASP.NET Core (CVE-2026-56170)
The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by a denial of service vulnerability as referenced in the vendor advisory. - Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to den...