150499 matches found
PT-2026-89926
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...
CVE-2026-74835: Allocation of Resources Without Limits or Throttling
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...
EUVD-2026-69212
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-84203
Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-78012: Stack-based Buffer Overflow
An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning. The result could be memory corruption, a device crash, or a potential remote attack vector without t...
TencentOS Server 4: keylime-agent-rust (TSSA-2026:0891)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0891 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
openSUSE 16 Security Update : python-h2 (openSUSE-SU-2026:21693-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21693-1 advisory. This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, whic...
Malicious code in aether-foundation-request-tectonophysics (npm)
Source: amazon-inspector ffc9fd0a034150e047fd366ef04b684968fb67604112d8700999a30a191a84c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in aether-link-request-promise (npm)
Source: amazon-inspector 6cd2a6fbdd0fd2a3975dbf408d242fa7675a68209e8547ca050aaf6e2ae6ac19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in acamar-cosmos-start-request (npm)
Source: amazon-inspector 3efa5ae8bc81623cf737a4266be3ae0e7ad05a0df1ec0880493ee4f35ccb7ae1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in abstract-http-request (npm)
Source: amazon-inspector 84130e04f5582700fd6841f67e465fb571518a710f3257fae0990653bf08aa92 The package abstract-http-request was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in abiogenesis-webpack-innercore-request (npm)
The package abiogenesis-webpack-innercore-request was found to contain malicious code. --- Credit: OpenSSF source...
CVE-2026-82957 hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...
CVE-2026-82957
CVE-2026-82957 is a server-side request forgery (SSRF) in hyperledger-firefly up to version 1.4.0. The flaw resides in the ValidateOptions function within internal/events/webhooks/webhooks.go of the Webhook Subscription component. Manipulating the url argument allows a remote, unauthenticated att...
CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...
CVE-2026-77352
Wallos (open-source, self-hostable personal subscription tracker) versions 2.0.0 through before 5.0.0 contain an authenticated SSRF via the per-user SMTP notification host. Any authenticated user (no admin rights required) can set their notification SMTP host to an internal or link-local address....
CVE-2026-82852
Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...
CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...
CVE-2026-77351
Wallos , an open-source self-hosted personal subscription tracker, is vulnerable to SSRF prior to version 5.0.0 . The root cause is that any authenticated user can store an arbitrary SMTP host—including private and cloud-metadata IP addresses—in their personal email notification settings, with no...
CVE-2026-61638
CVE-2026-61638 affects Wallos , an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6 , the endpoint POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from the request body with no SSRF validation , allowing PHPMailer to connec...