137 matches found
GO-2025-3991 Coder AgentAPI exposed user chat history via a DNS rebinding attack in github.com/coder/agentapi
Coder AgentAPI exposed user chat history via a DNS rebinding attack in github.com/coder/agentapi...
DNS Rebinding and Manipulating CORS Headers Enables Exfiltration of Information
Overview A vulnerability in cross-origin resource sharing CORS headers in Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox enables the CORS policy to be manipulated. Combined with a DNS rebind, an attacker can send arbitrary requests to services listening on arbitrary ports regardless...
EUVD-2018-3355
Malware in sbrugna...
EUVD-2007-5253
Malware in sbrugna...
EUVD-2007-5254
Malware in sbrugna...
EUVD-2016-0007
Malware in sbrugna...
EUVD-2019-6313
Malware in sbrugna...
EUVD-2018-0100
Malware in sbrugna...
EUVD-2021-16073
Malware in sbrugna...
EUVD-2020-19485
Malware in sbrugna...
EUVD-2019-10883
Malware in sbrugna...
EUVD-2021-10017
Malware in sbrugna...
EUVD-2021-0816
Malware in sbrugna...
EUVD-2023-1043
Malicious code in bioql PyPI...
EUVD-2025-14755
Malicious code in bioql PyPI...
EUVD-2023-56908
Malicious code in bioql PyPI...
EUVD-2022-7411
Malicious code in bioql PyPI...
EUVD-2025-31619
Malicious code in bioql PyPI...
CVE-2025-59956 AgentAPI exposed user chat history via a DNS rebinding attack
AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Versions 0.3.3 and below are susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. An attacker can gain access to the /messages endpoint served by the Agent API. This allows for th...
DNS Rebinding
Overview Affected versions of this package are vulnerable to DNS Rebinding when hosted over plain HTTP on localhost. An attacker can access sensitive user data and chat history via the /messages endpoint that may include secret keys, file system contents, and intellectual property by enticing the...