LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

ImpactAny authenticated LiteLLM proxy user could redirect an outbound provider call to a destination they control and cause the proxy to send its own configured provider credentials to that destination. The proxy's request-body validation was a denylist that did not cover every sensitive paramete...

CVE-2026-22015-Serverless-Function-Environment-Variable-Injection-via-Event

CVE-2026-22015 – Inyección de variables de entorno en funciones serverless a través del evento Código del programa simulación de Python Lambda lambdaenvinject.py - Vulnerable function that reads env from event import os, json def handlerevent, context: The event contains environment variable...

CVE-2026-63720-datamodel-code-generator

CVE-2026-63720: Inyección de código en datamodel-code-generator a través de customBasePath no validado Gravedad: Alta, CVSS 3.1 7.5 / CVSS 4.0 7.5 asignada por VulnCheck, la CNA Techo ambiental despliegue como servicio de red: hasta 9.8 Vector v4.0:...

GHSA-HF8H-97GM-4X2P SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

Summary /api/file/getUniqueFilename takes a path from the request body and passes it to a filesystem existence check with no validation, confinement or authorization. The response distinguishes paths that exist from paths that do not, so an anonymous reader in publish mode can probe arbitrary...

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

Summary /api/file/getUniqueFilename takes a path from the request body and passes it to a filesystem existence check with no validation, confinement or authorization. The response distinguishes paths that exist from paths that do not, so an anonymous reader in publish mode can probe arbitrary...

CVE-2026-17053

The Zephyr RTOS SMBus driver API contains a vulnerability where smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() are exposed as syscalls. These syscalls fail to perform K_SYSCALL_MEMORY_READ/WRITE validation on the caller-supplied struct smbus_callback *cb pointer, forwarding it direc...

CVE-2026-17053 SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

The SMBus driver API exposed smbussmbalertremovecb and smbushostnotifyremovecb as Zephyr syscalls. Their verifiers in drivers/smbus/smbushandlers.c validated only the dev argument with KSYSCALLOBJdev, KOBJDRIVERSMBUS and forwarded the caller-supplied struct smbuscallback cb pointer into kernel-mo...

fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

CVE-2020-35667-PoC

CVE-2020-35667-PoC Resumen AVISO El comportamiento vulnerable ilustrado a continuación fue verificado empíricamente a partir de artefactos descompilados y parcheados, que intentan asemejarse a la vulnerabilidad original inferida con un enfoque heurístico, dado que la versión original vulnerable d...

CVE-2023-49471

CVE-2023-49471 Tipo de vulnerabilidad Blind SSRF Producto y versión afectados Bar assistant / -----------------------------8290129562507108753887567115 Content-Disposition: form-data; name...

CVE-2021-21234

CVE-2021-21234 CVE-2021-21234 Recorrido de directorios en Spring Boot spring-boot-actuator-logview añade un simple visor de archivos de registro como endpoint del actuator de Spring Boot en una biblioteca. Es el paquete Maven «eu.hinsch:spring-boot-actuator-logview». Existe una vulnerabilidad de...

GitLab-CVE-2021-22205-

Impacto de la vulnerabilidad Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.9. GitLab no validaba correctamente los archivos de imagen que se pasaban a un analizador de archivos, lo que provocaba la ejecución remota de comandos. Versión afectada Gitlab...

CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

EUVD-2026-90592

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...

Rocky Linux 8 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_69112)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202669112 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_71608)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202671608 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block directly...

Rocky Linux 8 [CIQ] Security Update: squashfs-tools / squashfs-tools-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3139)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243139 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic link...

GHSA-47HW-GVQ5-R2GM russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened

Summary CVE-2026-68930 was fixed by adding Session::isestablishedchannel in russh/src/server/encrypted.rs, which gates every channel-scoped SERVER-side message CHANNELREQUEST, CHANNELDATA, CHANNELEOF, CHANNELCLOSE, CHANNELWINDOWADJUST, CHANNELEXTENDEDDATA on enc.channels.get&channel.issomeand|c|...

EUVD-2026-89632

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

MiracleLinux 8 : perl-DBI-1.641-3.el8_10 (AXSA:2026-1942:06)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1942:06 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block...