50 matches found
CVE-2026-110610
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
EUVD-2026-101238
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
CVE-2026-110610
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
CVE-2026-110610
The ruoyi-vue-pro framework (versions through 2026.09 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the yudao-module-ai image service. Specifically, the midjourney imagine endpoint fails to properly validate the referImageUrl parameter. This allows authenticated users to fo...
CVE-2026-110610 ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
PT-2026-114052
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
CVE-2026-110610: Server-Side Request Forgery (SSRF)
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool...
@agimon-ai/imagine-mcp (>=0.6.0, <=0.30.14), rosetta-squint-decode (1.0.0) potentially affected by CVE-2026-84447 via libheif-js (>=1.17.1, <=1.19.8)
libheif-js NPM version =1.17.1, =0.6.0, =0.30.14 - rosetta-squint-decode 1.0.0 Source cves: CVE-2026-84447 Source advisory: MEND:CVE-2026-84447...
@agimon-ai/imagine-mcp (>=0.6.0, <=0.30.14), rosetta-squint-decode (1.0.0) potentially affected by CVE-2026-84448 via libheif-js (>=1.17.1, <=1.19.8)
libheif-js NPM version =1.17.1, =0.6.0, =0.30.14 - rosetta-squint-decode 1.0.0 Source cves: CVE-2026-84448 Source advisory: MEND:CVE-2026-84448...
ANT-2026-NQ9DPCK0 · gdal · Heap-buffer-overflow
heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-NQ9DPCK0: Heap-buffer-overflow in hfaopen.cpp:3533 Wh...
EUVD-2024-37803
Malicious code in bioql PyPI...
When AI chatbots leak and how it happens
In a recent article on Cybernews there were two clear signs of how fast the world of AI chatbots is growing. A company I had never even heard of had over 150 million app downloads across its portfolio, and it also had an exposed unprotected Elasticsearch instance. This needs a bit of an...
A Bootiful Podcast: Java Champion and legend Henri Tremblay
Hi, Spring fans! In this installment I talk to Henri Tremblay, head of TS Imagine Canada, Java Champion, Montreal JUG leader, EasyMock lead dev and all around legend!...
MAL-2025-2278 Malicious code in rexz-imagine-ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a5880974c43ddaa1e24f3eecce7e9eb1e66d31adb347a095436a27316c30097 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in rexz-imagine-ai
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in rexz-imagine-ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a5880974c43ddaa1e24f3eecce7e9eb1e66d31adb347a095436a27316c30097 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Imagine Cup Platform Code Execution
The vulnerability of the Imagine Cup platform’s Microsoft Azure Functions component is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk
A critical security flaw has been disclosed in the Kubernetes Image Builder that, if successfully exploited, could be abused to gain root access under certain circumstances. The vulnerability, tracked as CVE-2024-9486 CVSS score: 9.8, has been addressed in version 0.1.38. The project maintainers...
Microsoft Imagine Cup site information disclosure vulnerability
Microsoft Imagine Cup is a developer tool from Microsoft Corporation USA. The Microsoft Imagine Cup site suffers from an information disclosure vulnerability that stems from incorrect access control. An attacker could exploit the vulnerability to elevate privileges over a network...