CVE-2025-54123

Hoverfly (versions

CVE-2025-54123 Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists i...

CVE-2025-54123 Hoverfly vulnerable to remote code execution at `/api/v2/hoverfly/middleware` endpoint due to insecure middleware implementation

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at /api/v2/hoverfly/middleware endpoint due to insufficient validation and sanitization in user input. The vulnerability exists i...

PT-2025-37088

Name of the Vulnerable Software and Affected Versions Hoverfly versions prior to 1.12.0 Description Insufficient validation and sanitization of user input in the middleware functionality allows for command injection. The issue resides in the middleware management API endpoint...

Linux Distros Unpatched Vulnerability : CVE-2017-3626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware subcomponent: Java Server Faces. The supported version that is affected is...

Vite's `server.fs` settings were not applied to HTML files

Summary Any HTML files on the machine were served regardless of the server.fs settings. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - appType: 'spa' default or appType: 'mpa' i...

Malicious code in wasat-astrobiology-chariklo-middleware (npm)

The package wasat-astrobiology-chariklo-middleware was found to contain malicious code...

Malicious code in middleware-indus-membrane-yonder (npm)

The package middleware-indus-membrane-yonder was found to contain malicious code...

Malicious code in middleware-markdown-pdf-entanglement-relay (npm)

The package middleware-markdown-pdf-entanglement-relay was found to contain malicious code...

MAL-2025-45183 Malicious code in middleware-indus-membrane-yonder (npm)

The package middleware-indus-membrane-yonder was found to contain malicious code...

MAL-2025-46558 Malicious code in wasat-astrobiology-chariklo-middleware (npm)

The package wasat-astrobiology-chariklo-middleware was found to contain malicious code...

MAL-2025-46874 Malicious code in zenobia-jupiter-middleware-eridanus (npm)

The package zenobia-jupiter-middleware-eridanus was found to contain malicious code...

MAL-2025-44092 Malicious code in eclipse-sublimation-epigenetics-middleware (npm)

The package eclipse-sublimation-epigenetics-middleware was found to contain malicious code...

MAL-2025-45184 Malicious code in middleware-markdown-pdf-entanglement-relay (npm)

The package middleware-markdown-pdf-entanglement-relay was found to contain malicious code...

webpack-dev-middleware Path Traversal vulnerability

...

Linux Distros Unpatched Vulnerability : CVE-2025-30218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which...

Linux Distros Unpatched Vulnerability : CVE-2019-18978

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the rack-cors aka Rack CORS Middleware gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources becau...

Linux Distros Unpatched Vulnerability : CVE-2021-38562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Best Practical Request Tracker RT 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a timing attack against...

CVE-2025-57822 Next.js Improper Middleware Redirect Handling Leads to SSRF

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...

CVE-2025-57822 Next.js Improper Middleware Redirect Handling Leads to SSRF

Next.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has...