axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

CVE-2026-64623

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter, where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature ver...

CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-63735

SurrealDB is affected: versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing an authenticated user to invoke endpoints in other namespaces/databases by specifying the target scope in the URL path. This could let attackers read sensitive data or trigger...

CVE-2026-63735 SurrealDB before 3.2.0 Authentication Bypass via Custom API

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by...

Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

CVE-2026-2445

CVE-2026-2445 involves a reflected cross-site scripting (XSS) flaw in multiple WSO2 products where user-supplied input in a URL parameter is rendered without proper sanitization/encoding. The underlying issue is unsafe handling of URL parameters that can inject malicious JavaScript, enabling brow...

Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation

A flaw was found in Apache HTTP Server. This escalation of privilege vulnerability allows local attackers, specifically those with the ability to author .htaccess files, to read sensitive files. This flaw enables unauthorized access to files with the privileges of the httpd user, potentially...

Adobe ColdFusion - Arbitrary File Read

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary...

CVE-2026-51026

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...

PT-2026-62023

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code...

CVE-2026-51031

FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...

TencentOS Server 3: python-urllib3 (TSSA-2026:0624)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0624 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

EUVD-2026-45990

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...

PT-2026-61734

Name of the Vulnerable Software and Affected Versions FlareSolverr versions prior to 3.4.7 Description A server-side request forgery SSRF issue exists in the '/v1' API endpoint. This flaw allows a remote attacker to induce the server to make requests to an unintended location, potentially enablin...

CVE-2026-51026

CVE-2026-51026 affects FileThingie v2.5.7 with a directory traversal vulnerability that allows a remote attacker to obtain sensitive information via a crafted request. CVSSv3.1 metrics show AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (base score 6.5, MEDIUM). No remediation details are provided in the su...

Cisco ASA/FTD WebVPN/AnyConnect Improper Input Validation (CVE-2020-3452)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability i...

PT-2026-61551

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description Custom API routes fail to validate namespace and database scope, which allows authenticated users to invoke endpoints across different namespaces or databases. An attacker with valid credentials fo...