149130 matches found
Malicious code in chalk-magellan-lacerta-request (npm)
The package chalk-magellan-lacerta-request was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in cassini-uglify-js-terser-webpack-plugin-request (npm)
Source: amazon-inspector 21ce09785669244e7591203f571d73f65427bc99ebccda71d751eb0a498be0e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in cassini-hydra-request-fetch (npm)
The package cassini-hydra-request-fetch was found to contain malicious code. --- Credit: OpenSSF source...
Resource Exhaustion
Spring WebFlux is vulnerable to Resource Exhaustion. The vulnerability is due to the PartEventHttpMessageReader not enforcing the maxPartSize limit when maxInMemorySize is set to -1, where an attacker can send arbitrarily large multipart requests that consume excessive memory and trigger a...
CVE-2026-80181 Apache Allura: Server-side request forgery
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
CVE-2026-80181 Apache Allura: Server-side request forgery
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
EUVD-2026-70922
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
CVE-2026-75754
Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...
kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
A flaw was found in the Linux kernel's iSCSI Internet Small Computer System Interface target functionality. This vulnerability, a heap overrun, occurs because the iscsiencodetextoutput function does not properly check buffer capacity when processing login requests. A remote attacker could exploit...
EUVD-2026-70865
Missing Authentication for Critical Function, Server-Side Request Forgery SSRF, and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in wi...
CVE-2026-85380 light0011 cms UEditor controller.php catchimage server-side request forgery
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...
CVE-2026-85380 light0011 cms UEditor controller.php catchimage server-side request forgery
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...
CVE-2026-85380 light0011 cms UEditor controller.php catchimage server-side request forgery
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects the function catchimage of the file Public/ueditor/php/controller.php of the component UEditor. This manipulation of the argument source...
SUSE CVE-2026-84394
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...
PT-2026-85451
Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2 Description An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema...
PT-2026-85771
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...
CVE-2026-79426
An arbitrary file deletion vulnerability in the /adminapi/file/videodatasave component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request...
CVE-2026-79426
The CRMEB v6.0.0 platform contains an arbitrary file deletion vulnerability within the /adminapi/file/video_data_save component. This flaw allows authenticated attackers to delete arbitrary files on the system by sending a crafted POST request . Exploitation details or specific proof-of-concept l...
CVE-2026-79423
A remote code execution (RCE) vulnerability exists in the admin_config.php component of seacms v13.6 . The flaw allows an authenticated attacker to execute arbitrary code by sending a crafted POST request . This vulnerability is characterized as an Improper Neutralization of Special Elements used...