2278928 matches found
javapackages-tools:201801 security update
An update is available for module.javacc-maven-plugin, maven2, felix-parent, xalan-j2, module.forge-parent, atinject, jdepend, objectweb-pom, osgi-core, module.maven-parent, plexus-i18n, jline, javacc, module.sisu-mojos, module.maven-reporting-impl, junit, maven-shared-incremental,...
GHSA-42H9-826W-CGV3 Axios: Excessive recursion in formDataToJSON can cause denial of service
Summary Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON / named formToJSON API and the default request transform used when FormData is sent with an application/json content type. Applications are affected when they pa...
Axios: Excessive recursion in formDataToJSON can cause denial of service
Summary Axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON, the helper behind the public axios.formToJSON / named formToJSON API and the default request transform used when FormData is sent with an application/json content type. Applications are affected when they pa...
CVE-2026-64194
Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...
CVE-2026-64193
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval. There is some...
GHSA-XJ6Q-8X83-JV6G Axios: Prototype pollution auth subfields can inject Basic auth
Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...
Axios: Prototype pollution auth subfields can inject Basic auth
Summary Axios versions after the GHSA-q8qp-cvcw-x6jj fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own auth object that omits username or password,...
CVE-2026-58482
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...
CVE-2026-46555
WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...
CVE-2026-46555
The CVE applies to WhatsApp MCP Server, where the whatsapp-bridge HTTP API on 127.0.0.1:8080 is unauthenticated and lacks Host header validation. The /api/send endpoint accepts an absolute media_path, enabling a local caller (including sibling MCP servers, IDE extensions, or other processes in th...
CVE-2026-46555 WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...
CVE-2026-46555 WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration
WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...
CVE-2026-46555
WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...
EUVD-2026-46037
WhatsApp MCP Server is a Model Context Protocol MCP server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the whatsapp-bridge HTTP API listens on 127.0.0.1:8080 without authentication and without Host header validation, and the /api/send endpoint accepts...
[R1] Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2 and 6.8.0: SC202607.1
R1 Stand-alone Security Patch Available for Tenable Security Center Versions 6.6.0, 6.7.2 and 6.8.0: SC202607.1 Arnie Cabral Mon, 07/20/2026 - 13:01 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components apache, OpenSSL,...
fastjson-jsontype-rce-lab
fastjson @JSONType remote-class-load RCE — lab, exploit & sc...
JLSEC-2026-777
HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hbmalloc returns NULL before using placement new to construct an object at t...
Exploit for Improper Input Validation in Apache Camel
camel-kafka kafka.OVERRIDETOPIC Header Injection Reproducer...
CVE-2026-58482 Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...
CVE-2026-58482
Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called ApprovalInbox lib/approval-inbox.ts. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit human approval for high-risk operations...