393 matches found
reversemap
reversemap Analyse SQL injection attempts in web server logs The program can either be run in batch mode or interactive mode. In batch mode the program will accept Apache web server logs and will deobfuscate requested URLs from the logs. In interactive mode the program will prompt for user input...
cve-2026-59891-control-lab
CVE-2026-59891 Regression & Control Lab Изолированная лаборатория и аудит в режиме «только чтение» для сравнения реально уязвимой и исправленной версий @sigstore/oci с одинаковыми входными данными, а также для проверки условий эксплуатации в различных окружениях. CVE Reporter этого проекта —...
CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...
CVE-2026-75757
ash_admin (ash-project) is vulnerable to session/actor shadowing via a flawed client-side cookie reader. The JavaScript reads state cookies (e.g., actor_authorizing, actor_domain) using an unanchored regex (new RegExp(name + "=([^;]+)")) against document.cookie, so any cookie whose name merely en...
CVE-2026-82639
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
CVE-2026-82639
NextChat versions 2.15.8 through 2.16.1 are affected by an improper URL validation flaw in the proxy endpoint . The x-base-url header is validated via substring matching rather than proper hostname parsing, so any attacker-supplied URL containing the string api.openai.com passes validation. This ...
CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
EUVD-2026-68215
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
CVE-2026-82468
Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...
Astra Linux – Vulnerability in pcre3
In PCRE before version 8.44, libpcre allowed integer overflows due to a large number appearing after a ?C substring...
CVE-2026-17559
The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...
EUVD-2026-57239
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...
CVE-2026-14479
CVE-2026-14479 affects the Autodesk Installer IPC frame parser. A maliciously crafted input can cause improper validation of an input-specified position or offset, producing an out-of-range substring operation. The resulting condition may cause the NT AUTHORITY\SYSTEM service to terminate, yieldi...
CVE-2026-14479 Denial of Service in Autodesk Installer IPC Channel
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITY\SYSTEM...
PT-2026-71097
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerability to cause the NT AUTHORITYSYSTEM...
CVE-2026-67558
The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token...
Empty NIP-50 search filters can panic
The NIP-50 event-matching path searched event content with slice::windowssearch.len. An empty search string therefore called slice::windows0, which always panics instead of returning a match result. A remote client able to submit filters to an application using this matcher could trigger the pani...
CVE-2026-59897
A flaw was found in Hono, a web application framework. The AWS API Gateway v1 adapter incorrectly de-duplicates repeated request header values using a substring comparison, rather than an exact match. This can lead to incomplete data being received by middleware or application logic that relies o...