GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 POC para CVE-2021-22214: SSRF en Gitlab Descripción La instalación remota de GitLab contiene una vulnerabilidad de falsificación de solicitudes del lado del servidor SSRF como resultado de que la red interna para webhooks está habilitada. Un atacante remoto no autenticado puede...

CVE-2021-22214

CVE-2021-22214 描述 - CVE-2021-22214 的 POC：Gitlab CI Lint API 未授权 SSRF 漏洞 - 由 antx 于 2021-11-01 创建。 详情 - 当启用对内部网络的 webhook 请求时，GitLab CE/EE（影响从 10.5 开始的所有版本）中存在一个服务器端请求伪造漏洞，即使是在注册受限的 GitLab 实例上，未认证的攻击者也有可能利用该漏洞。 CVE 严重性 - attackComplexity: HIGH - attackVector: NETWORK - availabilityImpact: NONE...

sshconfig-lint

sshconfig-lint One engine for every place your SSH config changes. sshconfig-lint finds semantic mistakes in OpenSSH client configs: duplicate hosts, broken identity paths, unsafe options, weak algorithms, wildcard ordering, and tangled Include chains. Use the same rule codes locally, in Git hook...

nray

nray Overview Nray is a free, platform and architecture independent port and application layer scanner. nray runs in a distributed manner to speed up scans and to perform scans from different vantage points. Event-based results allow to further process information during the scan, e.g. using tool...

CVE-2021-22214

CVE-2021-22214 Gitlab CI Lint API未授权 SSRF漏洞 CVE-2021-22214 本文以及工具仅限技术分享，严禁用于非法用途，否则产生的一切后果自行承担。 Usage help root@kitploit: $ python3 gitlabssrf.py =============================================================== / | | | | | / / | | | | | | || | | | | | | | | | | | | | | | | / | ' \ \ \ | /| | | ||...

Astra Linux – Vulnerability in Ruby-Rack

A sequence injection vulnerability exists in Rack versions 2.0.9.1, 2.1.4.1, and 2.2.3.1. This vulnerability could allow for shell escapes in the Lint and CommonLogger components of Rack...

CVE-2026-85674 aider 0.86.2 Remote Code Execution via .aider.conf.yml

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

EUVD-2026-71130

aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...

CVE-2026-85674

aider (aider-chat) is a CLI-based AI coding assistant that automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), both of which are e...

sshconfig-lint v0.5.0

sshconfig-lint One engine for every place your SSH config changes. sshconfig-lint finds semantic mistakes in OpenSSH client configs: duplicate hosts, broken identity paths, unsafe options, weak algorithms, wildcard ordering, and tangled Include chains. Use the same rule codes locally, in Git hook...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204

Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...

EUVD-2026-64679

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: delve, stakater-reloader, cert-exporter, guac, crossplane-provider-aws-sns, authservice, crossplane-provider-aws-cloudformation, db-operator, octo-sts, sealed-secrets, terraform-provider-acme, argo-rollouts, crossplane-provider-azure-managedidentity, azcopy,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: stakater-reloader, guac, crossplane-provider-aws-sns, rancher-system-upgrade-controller, minio-object-browser, authservice, crossplane-provider-aws-cloudformation, db-operator, juicefs, octo-sts, opencost, sealed-secrets, wgcf, flux-notification-controller, kubeflow,...

ansible-lint-26.8.0-1.1 on GA media (moderate)

ansible-lint-26.8.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11503-1 Rating: moderate Cross-References: CVE-2026-11332 CVSS scores: CVE-2026-11332 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can no...

OPENSUSE-SU-2026:11503-1 ansible-lint-26.8.0-1.1 on GA media

These are all security issues fixed in the ansible-lint-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76429

These are all security issues fixed in the ansible-lint-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...