22453 matches found
CVE-2026-77310
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1 on their respective release lines, the java.net.InetAddress branch of FromStringDeserializer.Std.deserialize calls...
CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects
Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...
CVE-2026-76838
Hi.Events (an open-source event management platform) is affected by a Server-Side Request Forgery (SSRF) vulnerability in its webhook handling. The NoInternalUrlRule validates a webhook destination using gethostbyname() only at registration time , but the WebhookDispatchService never revalidates ...
CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects
Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...
Malicious code in @bpa-internal/bpa-utils (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15679 Malicious code in @bpa-internal/bpa-utils (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @bpa-internal/bpa-common (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15677 Malicious code in @bpa-internal/bpa-common (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @bpa-internal/bpa-types (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15678 Malicious code in @bpa-internal/bpa-types (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15676 Malicious code in @bpa-internal/bpa-auth (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @bpa-internal/bpa-auth (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2025-68825 HCL Hive is affected by incorrect default permissions
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications...
CVE-2025-68825 HCL Hive is affected by incorrect default permissions
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications...
Improper Validation of Syntactic Correctness of Input
Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6 and parseWithStatus host-processing paths in lib/utils.js and index.js. An attacker can route an...
Security Bulletin: Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
Summary Langflow OSS includes outbound network request functionality for provider validation and API request execution. Weaknesses in request destination validation and enforcement could allow authenticated users to induce requests to unintended internal or external network locations, which may...
CVE-2026-58314
A flaw was found in Gitea. This vulnerability, known as Server-Side Request Forgery SSRF, allows an attacker to trick the server into making requests to internal network resources. A logged-in user can exploit this by crafting malicious webhooks or repository migration configurations, leading to...
AppEngine vulnerability affects SICK ICR890-4 and SICK InspectorP6xx devices
Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK ICR890-4 and SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the device...
CVE-2026-10618
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...
CVE-2026-10618
Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...