CVE-2026-8590

Vulnerability in Spotfire Spotfire Enterprise Spotfire Server modules, Spotfire Spotfire Enterprise with External Consumers Spotfire Server modules, Spotfire Spotfire on Kubernetes Spotfire Server modules. This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0,...

EUVD-2026-43678

Vulnerability in Spotfire Spotfire Enterprise Spotfire Server modules, Spotfire Spotfire Enterprise with External Consumers Spotfire Server modules, Spotfire Spotfire on Kubernetes Spotfire Server modules. This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0,...

CVE-2026-8590: Undefined Security Weakness

Vulnerability in Spotfire Spotfire Enterprise Spotfire Server modules, Spotfire Spotfire Enterprise with External Consumers Spotfire Server modules, Spotfire Spotfire on Kubernetes Spotfire Server modules. This issue affects Spotfire Enterprise: through 14.0.12, through 14.4.2, through 14.5.0,...

PYSEC-2026-2650 misp-modules has nsafe remote resource fetching in expansion

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The htmltomarkdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally...

PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code

SummaryThe plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. The blocklist implemented in PluginSecurity.validateplugincode is incomplete and can be bypassed using several Python constructs that are not checked. An attack...

nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers

A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngxhttpproxyv2module or ngxhttpgrpcmodule with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart ...

Server-side Request Forgery (SSRF)

Overview misp-modules is a MISP modules are autonomous modules that can be used for expansion and other services in MISP Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the htmltomarkdown process. An attacker can access internal network resources by supplyi...

CVE-2026-13014 Remote Code Execution vulnerability in "Suspicious" application

A vulnerability in Thales CERT "Suspicious" application = 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent...

EUVD-2026-43306

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

CVE-2026-62143

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

CVE-2026-62143

The CVE-2026-62143 issue affects the html_to_markdown expansion module of misp-modules. An SSRF protection bypass occurred because IPv4-mapped IPv6 addresses were not normalised before checking blocked IP ranges, allowing an authenticated attacker to supply addresses like http://[::ffff:127.0.0.1...

CVE-2026-62143 Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

CVE-2026-62143 Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

MAL-2026-10404 Malicious code in @ica-gaming/slot-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504d38d63d27d90e825007078cde3c381daa6cfa73a8009797c60f3e889c44d0 The package presents itself as a deterministic WASM slot-math engine, but slotengine.wasm embeds obfuscated Node.js modules and Emscripten JS shim...

CVE-2026-62143: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF protection bypass existed in the htmltomarkdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

PT-2026-57660

A Server-Side Request Forgery SSRF protection bypass existed in the html to markdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges...

PT-2026-59300

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The html to markdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources...

PT-2026-59500

Summary PDM automatically loads project-local plugin paths from .pdm-plugins during Core initialization. Because this path is added via site.addsitedir, attacker-controlled .pth files inside the project plugin directory are processed and can execute Python code before normal CLI handling begins...

CVE-2026-57856: Improper Limitation of a Pathname to a Restricted Directory

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...