20706 matches found
MAL-2026-16029 Malicious code in cb-wallet-metadata (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef5687a0934fb8c3bbf63f534898153c0a41c337532e5ad3a8114290badb8a13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2026-86925
Use of Cache Containing Sensitive Information vulnerability in ash-project ash authentication oauth2 server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
VulnCheck KEV: CVE-2026-60105
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...
PT-2026-86877
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace...
CVE-2026-82755: Use of Cache Containing Sensitive Information
Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...
PT-2026-86768
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.46 Description Authenticated users can discover organisation metadata that should be hidden because the dashboard organisation picker does not apply the same visibility restrictions as the normal organisation index a...
Linux Distros Unpatched Vulnerability : CVE-2026-80881
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: fix buffer head management in ocfs2readblocks In ocfs2readblocks, caller should't assume that buffer head returned by 'sbgetblk' is exclusively owned and...
CVE-2026-82753: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...
CVE-2026-82757: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the...
CVE-2026-19633
creationtimestamp| type| source ---|---|--- 2026-09-06 17:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muuhrvsj4b2r 2026-09-06 17:47:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cr3gxk6hh7vc3 2026-09-06 20:18:43+00:00| seen|...
CVE-2026-86259
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
CVE-2026-86259
OpenMAIC versions before 1.0.1 contain a server-side request forgery (SSRF) vulnerability in non-production builds where URL validation is gated by environment. Unauthenticated attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter, reaching cloud instance met...
EUVD-2026-72126
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
CVE-2026-86259: Server-Side Request Forgery (SSRF)
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
PT-2026-86529
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
