49502 matches found
CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...
CVE-2026-54729
The CVE affects the DSSRF Node.js library. Prior to version 1.0.5, is_url_safe could treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN (dns.resolve4 yields no address and no dns.lookup fallback), enabling SSRF. The issue is fixed in version 1.0.5. Impact is SSRF with network atta...
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
Summary isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: js import isurlsafe from...
Server-side Request Forgery (SSRF)
Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the urlopen process in nltk.pathsec. An attacker can reach loopback or internal HTTP services by...
CVE-2026-59231
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
CVE-2026-56568
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...
UBUNTU-CVE-2026-18446
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...
EUVD-2026-51545
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
CVE-2026-59231
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
CVE-2026-59231
CVE-2026-59231 affects Maalfer Pentestify before 1.1.0, where SSRF can be triggered via the PDF export component. An authenticated user can cause outbound HTTP GET requests from the server to attacker-chosen destinations by supplying unvalidated URLs stored in the finding images field or the repo...
CVE-2026-18446
CVE-2026-18446 affects the fast-uri library prior to versions 4.1.2, 3.1.5, and 2.4.4 . A backslash-based introducer can substitute for a literal double forward slash required to recognize a URI authority, causing fast-uri to misparse the host while Node’s WHATWG URL parser treats backslashes dif...
Chromium: CVE-2026-17802 Side-channel information leakage in GPU
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17730 Side-channel information leakage in Autofill
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17978 Side-channel information leakage in WebCodecs
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17907 Side-channel information leakage in Network
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17851 Side-channel information leakage in Autofill
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17859 Side-channel information leakage in Favicons
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17942 Side-channel information leakage in SVG
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium: CVE-2026-17800 Side-channel information leakage in MediaRecording
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...