49482 matches found
CVE-2026-71850
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and request scoped values read inside the component take no part ...
CVE-2026-71850
Hono CVE-2026-71850 affects the Hono Web framework (3.8.0–4.12.33). memo() retains SSR output for later renders and reuses it when controls with identical props are rendered, while request-scoped values read during rendering (e.g., JSX Context via createContext/useContext, useRequestContext from ...
CVE-2026-44965
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...
CVE-2026-44965
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...
CVE-2026-44965
The Datadog Android application prior to version v545-5.9.2 is vulnerable to an improper export of Android components. Six specific App Widget configuration activities (IncidentWidgetActivity , MonitorSavedViewWidgetActivity , OnCallShiftsWidgetActivity , OnCallPagesWidgetActivity , SloWidgetActi...
EUVD-2026-54571
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...
CVE-2026-44965
In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, DashboardWidgetActivity are exported with no permission...
CVE-2026-17597
Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...
SUSE CVE-2026-70367
A Server-Side Request Forgery SSRF bypass vulnerability exists in "stunnel" 5.79 and lower when configured in SOCKS proxy mode. This flaw allows a client to bypass intended localhost restrictions by using IPv4-mapped IPv6 addresses e.g., "::ffff:127.0.0.1" or unspecified addresses "0.0.0.0", "::"...
EUVD-2026-54512
Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...
CVE-2026-17597 Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification
Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...
CVE-2026-17597
Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...
CVE-2026-17597
Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) in the email configuration verification feature. A user with nexus:settings:update can submit arbitrary host/port values to the email test/verification endpoint, causing the server to initiate outbound connections to internal or res...
CVE-2026-16637
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...
Security Bulletin: There is a vulnerability in freemarker-2.3.22.jar used by IBM Maximo Manage application in IBM Maximo Application Suite.
Summary There is a vulnerability in freemarker-2.3.22.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details ID:WS-2020-0455 DESCRIPTION: Affected versions of this package are vulnerable to Server-side Template Injection SSTI. By allowing user input into...
JLSEC-2026-1177 FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX...
FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. Whe...
CVE-2026-16637 OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...
CVE-2026-16637
OPeNDAP Hyrax is vulnerable to Server Side Request Forgery (SSRF) and credential disclosure due to unvalidated HTTP redirects. The software fails to verify if a redirected destination (HTTP 3xx) remains within the AllowedHosts allowlist. This allows an unauthenticated remote attacker to force the...
CVE-2026-16637 OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...
CVE-2026-16637
OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...