70 matches found
CVE-2026-24471
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...
CVE-2026-24471 Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...
CVE-2026-24471 Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...
CVE-2026-24471
The CVE-2026-24471 issue affects Continuwuity and Conduit-derived servers (Continuwuity, Conduit, Grapevine, Tuwunel). A malicious remote server can induce the victim to sign an arbitrary event during user interactions such as leaving a room, joining a room, or knocking on a room, by requesting a...
CVE-2026-24471
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...
CVE-2026-24471 Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...
continuwuity 安全漏洞
Continuwity is an open-source family server developed by Continuwity. There is a security vulnerability in Continuwity, which arises when users leave a room, join another room, or make a knock sound. In such cases, the victim’s server may sign any event provided by the remote server...
PT-2026-5720
Name of the Vulnerable Software and Affected Versions Continuwuity versions prior to 0.5.1 Conduit versions prior to 0.10.11 Grapevine versions prior to 0aae932b Tuwunel versions prior to 1.4.9 Description A flaw exists that allows a malicious remote server to cause a local server to sign an...
Knock Subdomain Scan security vulnerability
Knock Subdomain Scan is a domain name scanning tool developed by Gianni Amato. Version 4.1.1 of Knock Subdomain Scan contains a security vulnerability, which stems from unfiltered server headers, potentially allowing for CSV injection attacks...
EUVD-2022-5675
Malicious code in bioql PyPI...
MAL-2025-8614 Malicious code in @malware-test-drunk-zorro-nizam-knock/test-mlw3-drunk-zorro-nizam-knock (npm)
The package @malware-test-drunk-zorro-nizam-knock/test-mlw3-drunk-zorro-nizam-knock was found to contain malicious code...
Malicious code in @malware-test-sumph-knock-still-treat/test-mlw3-sumph-knock-still-treat (npm)
The package @malware-test-sumph-knock-still-treat/test-mlw3-sumph-knock-still-treat was found to contain malicious code...
MAL-2025-9075 Malicious code in @malware-test-wises-knock-ceric-zibet/test-mlw3-wises-knock-ceric-zibet (npm)
The package @malware-test-wises-knock-ceric-zibet/test-mlw3-wises-knock-ceric-zibet was found to contain malicious code...
CVE-2020-13486
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...
CVE-2020-13485
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...
Malicious code in watch-knock-at-2023-watching-the-cabin-online-streaming-free-at-home (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in watch-knock-at-the-cabin-2023-full-online-free-on-streaming-at-home (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-3891 Malicious code in watch-knock-at-the-cabin-2023-full-online-free-on-streaming-at-home (npm)
--- -= Per source details. Do not edit below this line.=-...