112083 matches found
MAL-2026-6318 Malicious code in ts-bn-lint-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267 Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported fromstr recursively walks...
CVE-2026-50023
CVE-2026-50023 affects yt-dlp. Before 2026-06-09, an issue allowed remote attackers to write arbitrary OS-shortcut files (e.g., .desktop, .url, .webloc) via the --write-link option by exploiting unsafe extensions that were on the allowlist, bypassing the prior CVE-2024-38519 remediation. This cou...
CVE-2026-54304
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authenticated user with permission to create or modify workflows and access to a SecurityScorecard credential with limited allowed domains could configure the SecurityScorecard node's report download...
CVE-2025-71376
creationtimestamp| type| source ---|---|--- 2026-06-23 14:52:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxnnmxy7m2q...
CVE-2026-56225
creationtimestamp| type| source ---|---|--- 2026-06-23 14:19:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlsg2pk52s...
CVE-2026-54892
creationtimestamp| type| source ---|---|--- 2026-06-23 14:07:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxl5ook3g2a...
CVE-2025-71341
creationtimestamp| type| source ---|---|--- 2026-06-23 13:59:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxkqcdnog2l...
CVE-2026-56275
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 and Plug.Conn.Query.decodeeach/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many...
CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-56275
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-56275
CVE-2026-56275 concerns Flowise prior to 3.1.0, where the Execute Flow node is vulnerable to a server-side request forgery (SSRF). By supplying intranet addresses in the base URL field, an attacker can bypass security validation and initiate HTTP requests to internal network addresses, potentiall...
CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-48875
creationtimestamp| type| source ---|---|--- 2026-06-23 10:15:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mox66eggyl2b...
CVE-2026-48868
creationtimestamp| type| source ---|---|--- 2026-06-23 09:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mox2synokh2b...
CVE-2026-8379
creationtimestamp| type| source ---|---|--- 2026-06-23 08:21:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowxtmrwaw2c...
CVE-2026-8378
creationtimestamp| type| source ---|---|--- 2026-06-23 08:16:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowxko6srr2l...
Improper Access Control
LangGraph Python SDK is vulnerable to Improper Access Control. The vulnerability is due to unsafe URL path construction using unsanitized user-supplied identifiers, where special characters in identifier values can alter the intended request path and target unintended resources, allowing attacker...