MAL-2026-17557 Malicious code in css-svqggc-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry,...

CVE-2021-41773

Apache HTTP Server 2.4.49 - استغلال اجتياز المسار وتنفيذ التعليمات البرمجية عن بُعد RCE نسخة مُصحَّحة الوصف هذا استغلال لثغرة Apache HTTP Server 2.4.49 المعروفة باسم CVE-2021-41773. كانت النسخة الأصلية من الاستغلال المنشورة في Exploit-DB تحتوي على أخطاء في الصيغة والتنفيذ، لذلك تم تصحيح هذه النسخ...

nosurf-cve-2025-46721

CVE-2025-46721: ثغرة CSRF بسبب فشل عمليات التحقق من نفس المصدر في justinas/nosurf ماذا حدث؟ هل أنا متأثر؟ إثبات المفهوم التصحيح الشكر والتقدير ماذا حدث؟ جميع إصدارات nosurf قبل 1.2.0 فشلت في تطبيق عمليات التحقق من نفس المصدر same-origin checks للطلبات الواردة. حدث هذا بسبب الاعتماد على الحقل...

bifrost

Bifrost Serveur proxy HTTP/HTTPS/SOCKS5 haute performance Language: 中文 | English · Documentation site Bifrost est un serveur proxy haute performance, adapté à l'IA, écrit en Rust, inspiré de Whistle. Il offre des capacités d'interception de requêtes, de modification par règles, d'interception TLS...

cve-2021-41773

Rapport CVE-2021-41773 – Path Traversal Apache Résumé Vulnérabilité découverte dans Apache HTTP Server 2.4.49, permettant, selon la configuration du serveur web, d'exposer des fichiers sensibles du système via une attaque de Path Traversal. Path Traversal : un attaquant peut accéder à des fichier...

CVE-2022-21371

CVE-2022-21371 Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 تضمين الملفات المحلية Exploit Title: Oracle WebLogic Server 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 Local File Inclusion Date: 25/1/2022 Exploit Author: Jonah Tan @picar0jsu Vendor Homepage:...

CVE-2023-44487

CVE-2023-44487 — مختبر اختبار إعادة الضبط السريع لـ HTTP/2 بيئة تعليمية للواجب المنزلي 4 لمقرر LTAT.04.022. أربع حاويات تتيح لك فحص ومقارنة الإعدادات غير المُصحَّحة مقابل المُصحَّحة. خريطة المنافذ الحاوية| المنفذ| البرنامج| الحالة ---|---|---|--- nginx-vuln| 8441| nginx 1.24| غير مُصحَّح...

CVE-2023-5044

CVE-2023-5044 إثبات المفهوم لـ CVE 2023 5044 المتطلبات الأساسية Kind: v0.20.0 Kubectl: v1.29.3 Docker: v26.0.0 إثبات المفهوم امنح Docker الصلاحيات الصحيحة sudo usermod -aG docker $USER && newgrp docker ابدأ المجموعة cluster مع extraPortMapping و node-labels لتحضيرها لـ ingress. cat EOF | kind...

CVE-2021-41773

CVE-2021-41773 - Apache HTTP Server 2.4.49 Comment lancer le lab CVE-2021-41773-Path Traversal 1. Installez et lancez Docker sur votre PC/portable 2. Clonez ce dépôt GitHub 3. Accédez au dossier Path Traversal 4. Saisissez les commandes suivantes docker build -t cve-2021-41773-path-traversal . et...

CVE-2026-95265

Feehi CMS 2.1.1 is vulnerable to a Server-Side Request Forgery (SSRF) in the UEditor catchimage endpoint. The root cause is insufficient private-IP validation, which fails to block loopback or link-local addresses. This allows an attacker to probe internal HTTP services by analyzing response diff...

EUVD-2026-92781

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-95265

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

PT-2026-106226

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

Debian dla-4821 : libperl-dev - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4821 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4821-1 [email protected]...

CVE-2026-105648: Incomplete List of Disallowed Inputs

Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations. A...

PT-2026-106182

Name of the Vulnerable Software and Affected Versions Ghost versions 6.0.9 through 6.64.0 Description A validation issue in the Webmentions functionality allows an unauthenticated user to perform limited HTTP requests to hosts within the internal network of the Ghost server on certain network...

CVE-2026-95265

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-95265: Undefined Security Weakness

Feehi CMS 2.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe internal HTTP services through response differences...

CVE-2026-104956: Improper Neutralization of Special Elements in Data Query Logic

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

PT-2026-104736

A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server info of the file python/sglang/srt/entrypoints/http server.py of the component HTTP Endpoint. Such manipulation of the argument api key leads to cleartext transmission of sensitive informatio...