CVE-2026-64649

Next.js SSRF vulnerability CVE-2026-64649 affects Next.js versions 14.1.1–15.5.20 and 16.0.0–16.2.10 when a Server Action forwards or redirects a request. An attacker who can control Host-related headers can cause the server to send outbound requests to a malicious host, via Server Actions on cus...

USBurst

USBurst - DWC3 USB Descriptor Buffer Overflow Apple Secure Ro...

Improper Request Routing

http-proxy-middleware is vulnerable to improper request routing. The vulnerability is due to unanchored substring matching in the host+path router selector logic, where configured host+path entries are matched against attacker-controlled request metadata using partial string comparisons instead o...

PT-2026-37346

Name of the Vulnerable Software and Affected Versions Zabbix versions 6.0 through 7.x Description The Item history widget and the Plain text widget allow the execution of injected JavaScript when HTML display is enabled. This occurs when malicious JavaScript is sent from a monitored host controll...

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Summary Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, , and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be...

Malicious code in corstoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d343f604565676254c8b24e997c84396038593cf5259c15d044ec3c5ab3350 The package corstoken was found to contain malicious code. Source: ghsa-malware d7d7cc0fd416fdcbdfe3517bbfd1ffec7e67ce88349fb17ddd2b22e408f740ed Any...

EUVD-2025-206233

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will...

CVE-2025-64425 Coolify has host header injection in forgot password

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim, and modify the host header of the request to a malicious value. The victim will...

Contrast has insecure LUKS2 persistent storage partitions may be opened and used

Summary A malicious host may provide a crafted LUKS2 volume to a Contrast pod VM that uses the secure persistent volume feature. The guest will open the volume and write secret data using a volume key known to the attacker. LUKS2 volume metadata is a not authenticated and b supports null...

EUVD-2019-10705

Malware in sbrugna...

EUVD-2020-2484

Malware in sbrugna...

EUVD-2020-18479

Malware in sbrugna...

EUVD-2020-18478

Malware in sbrugna...

EUVD-2018-17178

Malware in sbrugna...

EUVD-2020-7220

Malware in sbrugna...

EUVD-2020-7259

Malware in sbrugna...

EUVD-2022-5496

Malicious code in bioql PyPI...

Kata Containers coco-tdx malicious host can circumvent initdata verification

...

CVE-2025-58354 Kata Containers coco-tdx malicious host can circumvent initdata verification

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. In Kata Containers versions from 3.20.0 and before, a malicious host can circumvent initdata verification. On TDX systems running confidential guests, ...

Kata Containers 代码问题漏洞

Kata Containers is an open source lightweight virtual machine builder from the Kata Containers community. A code issue vulnerability exists in Kata Containers 3.20.0 and prior versions, which stems from a malicious host that can bypass initdata authentication, potentially allowing an attacker to...