Lucene search
+L

24492 matches found

OSV
OSV
added 2026/08/05 12:52 p.m.8 views

MAL-2026-12402 Malicious code in new-native-tools-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a The package ships a single 10 MB Rust-compiled Linux x8664 N-API native module tools.linux-x64-gnu.node referenced by main, with a two-line README th...

5.5AI score
SaveExploits0References34
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 12:13 p.m.8 views

Malicious code in streak-calc-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b37a5aa06b2d75f250bd23ce01f2667646c1aa7609ec2323f226842e043e9d [email protected] is presented as a native math accelerator for streak calculations but ships a bundled Linux ELF at dist/calc.bin that the...

5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/05 10:3 a.m.16 views

Server-side Request Forgery (SSRF)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...

7.1CVSS5.4AI score0.00171EPSS
SaveExploits1References2
NVD
NVD
added 2026/08/05 8:16 a.m.10 views

CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

7.1CVSS0.00171EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/08/05 6:59 a.m.8 views

CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

7.1CVSS5.6AI score0.00171EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/08/05 6:59 a.m.41 views

CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

7.1CVSS0.00171EPSS
SaveExploits1References1
CVE
CVE
added 2026/08/05 6:59 a.m.40 views

CVE-2026-71211

MLflow’s AI Gateway allows an auth_config.api_base value to be stored without validation (scheme/host/IP range), and the gateway proxy endpoint then issues HTTP requests to api_base plus a caller-supplied path, returning the response body. The existing SSRF guard (_validate_webhook_url) is never ...

7.1CVSS5.3AI score0.00171EPSS
SaveExploits1References1
NVD
NVD
added 2026/08/05 6:16 a.m.7 views

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

8.7CVSS0.00466EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/05 4:54 a.m.57 views

CVE-2026-71190

OpenStack Swift proxy server vulnerability CVE-2026-71190 affects Swift up to 2.38.0. The proxy Accept header parser uses a qdtext pattern (?:[^"]|\.)* that allows catastrophic backtracking (ReDoS). An unauthenticated remote attacker can craft an Accept header to trigger exponential CPU usage, wh...

8.7CVSS5.6AI score0.00466EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/05 4:54 a.m.40 views

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

8.7CVSS0.00466EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/08/05 4:54 a.m.10 views

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

8.7CVSS5.6AI score0.00466EPSS
SaveExploits0References4Affected Software1
Debian CVE
Debian CVE
added 2026/08/05 4:54 a.m.7 views

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

8.7CVSS5.6AI score0.00466EPSS
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2026/08/05 12:0 a.m.6 views

Linux Distros Unpatched Vulnerability : CVE-2026-71190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The qdtext...

8.7CVSS5.6AI score0.00466EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/08/04 9:25 p.m.7 views

CVE-2026-16728

A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...

6.5CVSS5.5AI score0.00176EPSS
SaveExploits0References5
Chainguard
Chainguard
added 2026/08/04 8:23 p.m.13 views

CVE-2026-69192 vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

7.7CVSS6.7AI score0.00292EPSS
SaveExploits0
Chainguard
Chainguard
added 2026/08/04 8:23 p.m.16 views

CVE-2026-54272 vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

6.9CVSS6.6AI score0.00254EPSS
SaveExploits0
Chainguard
Chainguard
added 2026/08/04 8:23 p.m.17 views

GHSA-22JQ-VG5J-6VGG vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

5.3AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/04 8:23 p.m.14 views

CVE-2026-69198 vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

6.9CVSS6.2AI score0.00276EPSS
SaveExploits0
Chainguard
Chainguard
added 2026/08/04 8:23 p.m.11 views

GHSA-4XRF-JV44-H6HH vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

5.3AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/04 8:23 p.m.12 views

GHSA-MWP4-54F8-5FHR vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

5.3AI score
SaveExploits0
Rows per page
Query Builder