CVE-2025-58441

Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact o...

Malicious code in n8n-nodes-hfgjf-irtuinvcm-lasdqewriit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4dabf38b16acea59219df3a3f57a396f3ebe958985096579cd43c419609b764 The package n8n-nodes-hfgjf-irtuinvcm-lasdqewriit was found to contain malicious code. Source: ghsa-malware...

Siemens Ruggedcom ROX Improper Validation of Specified Type of Input (CVE-2024-11168)

he urllib.parse.urlsplit and urlparse functions improperly validated bracketed hosts , allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. This plugin only works with Tenable.ot...

Improper Validation of Syntactic Correctness of Input

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the region input field. An attacker can cause AWS API calls to be routed to unintended or non-existent hosts by supplying an invalid...

CVE-2026-22245 Mastodon has SSRF Protection bypass

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses unless specified in ALLOWEDPRIVATEADDRESSES to...

CVE-2025-62877 Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer

Projects using the SUSE Virtualization Harvester environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is...

Security update for curl

This update for curl fixes the following issues: CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect bsc1255731 CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile bsc1255733 CVE-2025-14819: Fixed issue where alteration of...

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch due to the libssh API fallback to a built-in global knownhosts file if the host was not found in the specified one. An attacker can bypass host authenticity checks by leveraging...

CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

ALPINE-CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

CVE-2025-15079

CVE-2025-15079 affects curl/libcurl when using SSH-based transfers (SCP/SFTP) with a libssh backend. The vulnerability arises in known_hosts handling: even if a per-file known_hosts is used, connections could be accepted for hosts not present in that file if they are recognized in the libssh glob...

CVE-2025-15079

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

CVE-2025-15079 libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

CVE-2025-15079 libssh global known_hosts override

When doing SSH-based transfers using either SCP or SFTP, and setting the knownhosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global knownhosts file...

MAL-2026-153 Malicious code in darknet-dispatches-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56bca60f1c0743747f152e1bb34d4c1242fc24bc3500bbc44d7dc2c5235e06e1 The package darknet-dispatches-internal was found to contain malicious code. Source: ghsa-malware...

MAL-2026-156 Malicious code in sparkling-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49e0e650696ea120abbbc0a198865731fbeea781cc9ee947bd39c8f7d76c4eab The package sparkling-cli was found to contain malicious code. Source: ghsa-malware 6185870baa4e15b65e8df51e713dcb6e3e54d79fd00389cfa0f86421cef94f6e...

Amazon Linux 2023 : docker (ALAS2023-2025-1340)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1340 advisory. SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read...

curl 安全漏洞

curl is an open source tool from cURL for transferring data from or to a server. A security vulnerability exists in curl that stems from libcurl incorrectly accepting connections to SSH hosts that are not listed in the specified knownhosts file...

EUVD-2025-206264

Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact o...

CVE-2025-58441 Knowage is vulnerable to blind server-side request forgery (SSRF)

Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The vulnerability allows attackers to send requests to arbitrary hosts/paths. Since the attacker is not able to read the response, the impact o...