110981 matches found
Malicious code in streak-daykit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b On import of the package's main entry, a top-level bootstrap IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing...
CVE-2026-71280 go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch
go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks...
CVE-2026-71280
go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks...
CVE-2026-71280 go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch
go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks...
CVE-2026-71270
Stirling-PDF CVE-2026-71270 affects the POST /api/v1/convert/url/pdf endpoint. Unlike its siblings (html/pdf, file/pdf, markdown/pdf), this endpoint was not updated with CustomHtmlSanitizer/SsrfProtectionService SSRF protections. It only validates that the initial URL resolves to a public IP, the...
CVE-2026-71270
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...
CVE-2026-46581
In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...
CVE-2026-71235
creationtimestamp| type| source ---|---|--- 2026-08-05 11:32:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgjhttl322...
CVE-2026-71240
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...
CVE-2026-46581
In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...
CVE-2026-46581
CVE-2026-46581 affects Eclipse Mojarra 2.3 and later. The vulnerability lies in how the URL handing in DefaultFaceletFactory handles remote URLs, failing to sanitize or block them, allowing an attacker to specify a URL to a remote Facelet that can be included and processed with the server’s privi...
CVE-2026-71240
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...
CVE-2026-71240
DjangoCRM exposes a vulnerability in the toggle_default_sorting view: it is the sole route in common/urls.py not wrapped by login_required or staff_member_required. The handler redirects to a caller-supplied next_url GET parameter after only validating secure_url(next_url) (which checks host agai...
CVE-2026-71240 DjangoCRM - Unauthenticated Open Redirect via toggle_default_sorting next_url Parameter
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...
EUVD-2026-53313
DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...
CVE-2026-25703
creationtimestamp| type| source ---|---|--- 2026-08-05 10:42:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/irqvimbknjzhj...
Malicious code in dateuuidv2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1 The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO at requi...
CVE-2026-18901
creationtimestamp| type| source ---|---|--- 2026-08-05 08:53:50+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msd5oiwmrl2g...
MAL-2026-12138 Malicious code in agent-bot-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299eb5fe496022e888ed0663d0be82ddb8fac108bcb9a223291449982c360530 Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the...