CVE-2026-77310

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...

CVE-2026-44517

A flaw was found in Buildah. Insecure handling of temporary directories and symlinks during the image build process, specifically within TempDirForURL, downloadToDirectory, and stdinToDirectory functions, allows a malicious server supplying a Git repository or tar archive to cause files outside t...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor Unauthentifizierte RCE über INLINE GraalVM Evaluator Conductor OSS / Orkes3.21.21 … vor 3.30.2 wertet benutzerbereitgestelltes JavaScript in INLINE und LAMBDA / DOWHILE / SWITCH Aufgaben mit einem GraalVM-Kontext aus, der mit vollem Host-Zugriff HostAccess.ALL erstellt...

CVE-2026-49468-LiteLLM-Auth-Bypass

CVE-2026-49468 — Bypass di autenticazione non autenticato in LiteLLM tramite confusione di route dell'Host-Header Bypass di autenticazione/autorizzazione pre-autenticazione nel proxy LiteLLM BerriAI. Un singolo header Host manipolato fa sì che il proxy valuti la sua decisione di autenticazione...

BadHost-CVE-2026-48710-Exploit

BadHost – CVE-2026-48710 Scanner Nur-Erkennungs-Scanner für den BadHost -Authentifizierungsumgehungsangriff in Starlette / FastAPI – bei dem die Auth-Middleware request.url.path anstelle von request.scope"path" liest, sodass ein präparierter Host-Header einen erlaubten Pfad einschleusen und die...

CVE-2026-71917 DrayTek VigorSwitch Multiple Models OS Command Injection via pingtrace

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...

EUVD-2026-64976

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary...

Malicious code in dims-svelte-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bad5399590f49863bf42eff11c2a4c9f22c7db3dbc91d710faa0dfc732f02a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14405 Malicious code in create-json-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

nibble

Nibble è uno strumento CLI per la scansione di rete locale che si concentra su velocità e facilità d'uso. Seleziona un'interfaccia di rete e scansiona la tua sottorete locale. Elenca gli host, il produttore hardware, le porte aperte e i relativi servizi. ⚡ Veloce come un fulmine, scansiona...

CVE-2026-34835-Black-box-Analysis

Questo repository fornisce un'analisi di sicurezza black-box di CVE-2026-34835 dal punto di vista di un penetration tester esterno. L'obiettivo non è fare reverse engineering della vulnerabilità, ma documentare come un valutatore di sicurezza possa identificare, validare e valutarne l'impatto...

CVE-2026-75931

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

CVE-2026-75899

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-66897

A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates...

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

PoC-for-CVE-2025-9074

CVE-2025-9074 - PoC für nicht authentifizierten Zugriff auf die Docker-API 📌 Übersicht Dieses Repository stellt einen Proof-of-Concept-Exploit PoC für CVE-2025-9074 bereit, der die nicht authentifizierte Offenlegung der Docker-Engine-API auf TCP-Port 2375 betrifft. Ein Angreifer, der auf diese...

EUVD-2026-64763

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-75899

fast-uri , a URI parser for Node.js, suffers from double percent-decoding of the hostname: it decodes percent escapes during parsing and decodes them again during authority recomposition. This violates RFC 3986 §2.4 (an implementation must not decode the same string more than once) and allows a s...

CVE-2026-75931

fast-uri , a URI parser for the Node.js ecosystem, is vulnerable to host confusion and policy bypass (CVSS 3.1: 7.5 HIGH ). The root cause is that the host is canonicalized to ASCII form only when the input carries an explicit scheme; scheme-relative references (host preceded by //) are returned ...