CVE-2026-34162

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint /api/core/app/httpTools/runTool is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers,...

EUVD-2026-17445

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint /api/core/app/httpTools/runTool is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers,...

EUVD-2024-2387

Malicious code in bioql PyPI...

CVE-2024-39899

PrivateBin’s YOURLS proxy (introduced in v1.5) allowed shortening any URL that contains the PrivateBin instance, enabling an authentication bypass where a non-public YOURLs proxy could be abused to shorten arbitrary domains. The root cause was a faulty guard that only checked containment, not pro...

CVE-2024-39899: Authentication Bypass by Primary Weakness

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was to allow using the YOURLs URL shortener without running the YOURLs instance without authentication and/or exposing the authentication toke...