150439 matches found
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
Malicious code in exec-nestjs-request-phoebe (npm)
Source: amazon-inspector 9e72addbe7ca43e486f1bf024c753f5b5a2fcc5d9d1ddecf6e7c75fd7c238ba8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in exec-less-request-cosmicweb (npm)
The package exec-less-request-cosmicweb was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in example-arc-server-request-local (npm)
Source: ossf-package-analysis f47e48a4969642e3e6ab7d39b5d8f25a7a6d7acf2bbeec054888cfeada839219 The OpenSSF Package Analysis project identified 'example-arc-server-request-local' @ 100.0.1 npm as malicious. It is considered malicious because: - The package executes one or more commands associated...
Malicious code in eslint-plugin-request-indus-magellan (npm)
Source: amazon-inspector 53ef0d07a987d27e4c659a7944026bc057f89b21342a892da7330296ce732087 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in envconfig-relay-request-weywot (npm)
Source: amazon-inspector 47db78c95ae987d173aa06cd11ad9777df685935d01b883b22c230b76637f93c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in enif-ceres-request-npm (npm)
Source: amazon-inspector bdd13e00db1b0e02341cc37a68e8140e103a121804f1a8515d8b75918eb4511a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in emergency-pull-request-probot-app (npm)
The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...
Malicious code in elektra-dactyl-request-envconfig (npm)
Source: amazon-inspector bbbf867cd96d4fb79ded3e165033b746149ccaff20c6e025881eb6ac8b4b9e61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in elektra-comet-kaus-request (npm)
Source: amazon-inspector f19e35c748b77d4b457b3cb6602edbd409762762c7000fa53eba59cea78c3b0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-78083 Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property 4.1.4 - The visitor booking properties.booking and agent contact form submission agents.sendmail endpoints processed POST requests without verifying Joomla session...
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
SummaryHTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...
PYSEC-2026-3878 Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
Summary Open WebUI protects server-side web fetches with two controls: the operator's list of excluded hosts, and a check that refuses private and internal addresses. Neither control was applied to the destination of an HTTP redirect. On a deployment where redirect following is enabled, any...
PYSEC-2026-3934 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Summary vllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...
PYSEC-2026-3930 unstructured: Server-Side Request Forgery in the URL-based partitioning
Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...
PYSEC-2026-3828 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests
Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...
plone.app.event vulnerable to denial of service via iCalendar import
ImpactBy abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk SSRF, and store XSS. PatchesThe problem has been patched in plone.app.event. For Plone 6.2: upgrade to...
PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
SummaryThe PraisonAI MCP server exposes an HTTP-stream transport praisonai mcp serve --transport http-stream that binds to localhost and, by default, has no API key. Its only access control for browser-originated requests is an Origin allowlist, which the code implements as required by the MCP...
PYSEC-2026-3890 PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
Summary The webhookurl field in the Jobs API silently passes validation when DNS resolution fails socket.gaierror, enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP passing validation then switch to an internal IP before the server makes the HTTP request...