127777 matches found
CVE-2026-51031
FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Summary A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable. If a bin entry contains .. path segments, it can resolve to a path...
webkitgtk: webkitgtk: Visiting a website may leak sensitive data
A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...
webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information
A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...
CVE-2026-63769 Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures,...
webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information
A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...
webkitgtk: webkitgtk: Visiting a website may leak sensitive data
A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...
CVE-2026-51026
Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...
axios: Axios: Information disclosure of proxy credentials via redirect flows
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...
CVE-2026-54910
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...
CVE-2026-64623
Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter, where the default local verifier accepts any non-empty string as valid. Unauthenticated attackers can submit forged APS delegation payloads with arbitrary scopes to bypass signature ver...
CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox
Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...
CVE-2026-63735
SurrealDB is affected: versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing an authenticated user to invoke endpoints in other namespaces/databases by specifying the target scope in the URL path. This could let attackers read sensitive data or trigger...
CVE-2026-63735 SurrealDB before 3.2.0 Authentication Bypass via Custom API
SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by...
Malicious code in paperclip-ai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...
CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...
CVE-2026-2445
CVE-2026-2445 involves a reflected cross-site scripting (XSS) flaw in multiple WSO2 products where user-supplied input in a URL parameter is rendered without proper sanitization/encoding. The underlying issue is unsafe handling of URL parameters that can inject malicious JavaScript, enabling brow...
Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation
A flaw was found in Apache HTTP Server. This escalation of privilege vulnerability allows local attackers, specifically those with the ability to author .htaccess files, to read sensitive files. This flaw enables unauthorized access to files with the privileges of the httpd user, potentially...
Adobe ColdFusion - Arbitrary File Read
ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary...
