CVE-2026-92700

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-92284

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of...

CVE-2026-92700 Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-92284 Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-92284 Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-92284

The Caddy server platform is vulnerable in version 2.11.3 and earlier due to an unbounded io.Copy operation within the modules/caddyhttp/replacer.go component. When resolving the {http.request.body} placeholder, the system reads the complete request body before any request-body middleware limits ...

CVE-2026-92284 Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

CVE-2026-92284

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

PT-2026-97609

Name of the Vulnerable Software and Affected Versions SoftNews Media Group DataLife Engine version 18.0 Description An issue exists in the Search Module within the strip data function of the engine/modules/search.php file. A remote attacker can trigger a SQL injection by manipulating the story...

CVE-2026-96604: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

CVE-2026-92284: Allocation of Resources Without Limits or Throttling

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

TencentOS Server 4: environment-modules (TSSA-2026:1035)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1035 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-96717

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The WorkflowsController exposes the moduleStatelessExecution action within the Security component's unlockedActions list. In the CakePHP framework, including an action in unlockedActions disables field...

Malicious Package

Overview @shared-runtime/modules is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

CVE-2026-61852

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-61743 Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

CVE-2026-36469

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery SSRF in core/modules/media.php -- uploadfrominet Media Manager's "Upload by URL" functionality...

PT-2026-96299

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user capable of creating or testing API connections can exploit a DNS rebinding condition. This occurs because the validateOutboundUrl function in server/modules/safeRequest.js...

PT-2026-96126

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Server-Side Request Forgery SSRF exists in the Media Manager's "Upload by URL" functionality. The issue is located in the upload from inet function within the core/modules/media.php file. Recommendations As a...