CVE-2026-92795

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

EUVD-2026-81058

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

CVE-2026-92795 Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

CVE-2026-92795

Coze Studio through 0.5.1 contains a Server-Side Request Forgery (SSRF) vulnerability in its plugin system. The root cause is a failure to restrict the server URL supplied when registering plugin tools, allowing authenticated users to craft plugin requests that make the backend fetch internal ser...

CVE-2026-92795: Server-Side Request Forgery (SSRF)

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

Malicious Package

Overview strapi-plugin-cms-tools is a malicious package. This package contains malicious code that conceals a command-and-control agent and credential harvester. A malicious actor published a coordinated campaign of thirty-six packages disguised as community Strapi CMS plugins. These packages...

ai.mattmann.mnemosyne:cas-crawler (1.11.0), ai.mattmann.mnemosyne:cas-filemgr (1.11.0) +1190 more potentially affected by CVE-2025-67030 via org.codehaus.plexus:plexus-utils (1.5.6)

org.codehaus.plexus:plexus-utils MAVEN version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - ai.mattmann.mnemosyne:cas-crawler 1.11.0 - ai.mattmann.mnemosyne:cas-filemgr 1.11.0 -...

MAL-2025-3591 Malicious code in vite-plugin-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56ca9dc73ad1724cba2621975411cb4f207c06e1526426ef7e257b805ac42800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-plugin-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56ca9dc73ad1724cba2621975411cb4f207c06e1526426ef7e257b805ac42800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in vite-plugin-tools

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Fedora: Security Advisory for maven-plugin-tools (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: maven-plugin-tools-3.9.0-6.fc40

The Maven Plugin Tools contains the necessary tools to be able to produce Mav en Plugins in a variety of languages...

au.net.ocean.maven.plugin:maven-plugin-tools (1.1), ch.hortis.sonar:sonar-maven-plugin (>=0.2, <=1.0.2) +402 more potentially affected by CVE-2022-4245 via org.codehaus.plexus:plexus-utils (1.1)

org.codehaus.plexus:plexus-utils MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - au.net.ocean.maven.plugin:maven-plugin-tools 1.1 - ch.hortis.sonar:sonar-maven-plugin =0.2, =0.5....

com.carrotgarden.maven:bintray-maven-plugin (>=1.4.20190427204453, <=1.5.20191113165555), com.carrotgarden.maven:maven-plugin-tools-annotations (1.2.20190427171248) +6 more potentially affected by CVE-2023-37460 via org.codehaus.plexus:plexus-archiver (3.4.1)

org.codehaus.plexus:plexus-archiver MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-archiver and may be impacted: - com.carrotgarden.maven:bintray-maven-plugin =1.4.20190427204453, =0.1.1, =3.0.1, =3.1.5 -...

org.apache.maven:maven-archiver (2.0-alpha-1), org.apache.maven:maven-plugin-tools-api (2.0-alpha-1) +3 more potentially affected by CVE-2021-26291 via org.apache.maven:maven-core (2.0-alpha-1)

org.apache.maven:maven-core MAVEN version 2.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.maven:maven-core and may be impacted: - org.apache.maven:maven-archiver 2.0-alpha-1 - org.apache.maven:maven-plugin-tools-api 2.0-alpha-1 -...