CVE-2026-55758

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src/main/java/dan200/computercraft/core/apis/http/options/AddressPredicate.java blocks the RFC 6052 64:ff9b::/96 NAT64 prefix but omits the R...

CVE-2026-73530

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73530: Server-Side Request Forgery (SSRF)

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

PT-2026-71797

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-67424: Server-Side Request Forgery (SSRF)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the HTTP modules http.get, http.request, and http.batch in src/core/modules/atomic/http/get.py, src/core/modules/atomic/http/request.py, and src/core/modules/atomic/http/batch.py validate only the initial...

EUVD-2024-41530

Malicious code in bioql PyPI...

CVE-2024-45597

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

CVE-2024-45597

Pluto (a Lua-based superset) is affected by CVE-2024-45597 due to scripts passing user-controlled values to http.request header values, which can allow an attacker to send arbitrary HTTP requests and potentially leverage authentication tokens in the same headers table. The issue is tied to header...

CVE-2024-45597 Pluto's http.request allows CR and LF in header values

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

CVE-2024-45597: Improper Neutralization of CRLF Sequences

Pluto is a superset of Lua 5.4 with a focus on general-purpose programming. Scripts passing user-controlled values to http.request header values are affected. An attacker could use this to send arbitrary requests, potentially leveraging authentication tokens provided in the same headers table...

CentOS 8 : resource-agents (CESA-2020:4605)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4605 advisory. - python-httplib2: CRLF injection via an attacker controlled unescaped part of uri for httplib2.Http.request function CVE-2020-11078 Note that Nessus has not...

CVE-2020-11078

In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for httplib2.Http.request could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as...

PT-2014-6023

Name of the Vulnerable Software and Affected Versions OpenStack PyCADF version 0.5.0 and earlier Telemetry Ceilometer versions 2013.2 before 2013.2.4 and 2014.x before 2014.1.2 Neutron versions 2014.x before 2014.1.2 and Juno before Juno-2 Oslo affected versions not specified Description The issu...