YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery

YesWiki 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of |URL wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication. id: CVE-2026-116205 info: name: YesWiki 4.7.0 - Unauthenticated Server-Si...

Analysis-for-stage1-shellcode-loader-from-hacking-

Analysis for stage1 shellcode loader from hacking team Flowchart of code Network IoC https://172\.20\.20\.164 Mozilla/4.0 compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MDDRJS...

PYSEC-2026-4212 Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

GHSA-P3FW-7699-7926 Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the HTML backend's...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use...

Insertion of Sensitive Information Into Sent Data

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HTML backend's...

Insertion of Sensitive Information Into Sent Data

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Insertion of Sensitive...

PT-2026-106245

Name of the Vulnerable Software and Affected Versions Docling versions 2.95.0 through 2.131.0 Description The HTML image resource loader in docling/backend/utils/image resource loader.py forwards headers configured via the HTMLBackendOptions.headers setting to every remote image URL specified by ...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Image Optimization remote fetch, which resolves and requests an allowlisted remote URL without constraining the address that name resolves to, so a host permitted by...

Malicious code in fabric-loader-core (npm)

Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the response body directly to vm.runInContext with a context...

MAL-2026-17306 Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

DEBIAN-CVE-2026-100693

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...

MAL-2026-17173 Malicious code in chromatitle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level,...

Malicious code in chromatitle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level,...

MAL-2026-16386 Malicious code in @mikudeveloper/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03bf7166a5353a0b22409ebbb724ee53f24394c9ff340df668c970772796e28 This package is a fork of Baileys that declares libsignal in package.json as github:tenka-san/libsignal-node — a git dependency with no commit SHA,...

Malicious code in express-mongo-santi (npm)

Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose is a remote-fetch-and-execute pipeline that fires when the...

Malicious code in dolyame-ui-react-dom-wrapper (npm)

Source: amazon-inspector 3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b On require of the package's main entry, helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlled Cloudflare Worker subdomains...

Malicious code in dolyame-ui-react-version-switch (npm)

Source: amazon-inspector 1ee4e207fd01bae956d7fe084377ecea438f81774ea01ca6b02a50c1962c6cca Package advertises itself as a React UI helper but its index.js unconditionally requires./vendor at load time. vendor.js selects a platform-specific asset path, fetches bytes over HTTPS from a randomly-order...