112833 matches found
CVE-2026-34359 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer uses String.startsWith to match request URLs against configured server URLs for authentication credential dispatch. Because configured...
CVE-2026-5205 chatwoot Webhook API trigger.rb Trigger server-side request forgery
A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched...
CVE-2026-5205
The CVE-2026-5205 vulnerability affects chatwoot up to version 4.11.2, specifically the Webhooks::Trigger function in lib/webhooks/trigger.rb of the Webhook API. The root cause is manipulation of the argument url, enabling server-side request forgery (SSRF). The issue is exploitable remotely, wit...
CVE-2026-5205 chatwoot Webhook API trigger.rb Trigger server-side request forgery
A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched...
CVE-2026-5205
A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.rb of the component Webhook API. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched...
CVE-2026-34373
creationtimestamp| type| source ---|---|--- 2026-03-31 16:19:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mielevfkfx2i 2026-04-02 19:26:18+00:00| seen| Telegram/zX6Kqs44rDek2r3jgp5vCS4jdZwe09icUbxsylGXOdI3O8...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
CVE-2026-34163
creationtimestamp| type| source ---|---|--- 2026-03-31 15:42:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miejbtf5cj2h 2026-03-31 17:24:58+00:00| seen| Telegram/ky16Z8CpY9UfGCFQKDuXqskkeRzODLCHisg6zhKBGmfTV8 2026-04-06 01:00:14+00:00| seen|...
Directory Traversal
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the mediaUrl and fileUrl parameters, which bypass validation of localRoots. An attacker can access arbitrary files on the local filesystem by supplying crafted...
Duplicate Advisory: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v8wv-jg3q-qwpq. This link is maintained to preserve external references. Original Description OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read...
CVE-2026-4799
In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL...
CVE-2026-32871
creationtimestamp| type| source ---|---|--- 2026-03-31 14:42:36+00:00| published-proof-of-concept| https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767 2026-04-02 17:05:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mijourb6jr27 2026-04-02 17:37:18+00:00|...
Exploit for Server-Side Request Forgery in Useplunk Plunk
CVE-2026-32096 SSRF via unvalidated AWS SNS SubscriptionCon...
CVE-2026-33581 OpenClaw < 2026.3.24 - Arbitrary File Read via mediaUrl and fileUrl Parameters
OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidate...
CVE-2026-32921
creationtimestamp| type| source ---|---|--- 2026-03-31 13:22:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miebhdabn32q 2026-03-31 18:13:59+00:00| seen| https://bsky.app/profile/agenticyield.bsky.social/post/3mierragxs62a...
CVE-2026-33672
creationtimestamp| type| source ---|---|--- 2026-03-31 12:00:57+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mie4w6kz7j2a...
CVE-2026-34937
creationtimestamp| type| source ---|---|--- 2026-03-31 11:14:22+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w37c-qqfp-c67f 2026-04-04 00:27:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimxzyujko2t 2026-04-04...
CVE-2026-34934
creationtimestamp| type| source ---|---|--- 2026-03-31 11:14:22+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cq8-3v94-434g 2026-04-04 00:07:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimwwebbtz22 2026-04-04...
CVE-2026-3106
creationtimestamp| type| source ---|---|--- 2026-03-31 10:48:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3midyuykuoa24 2026-03-31 11:17:40+00:00| seen| Telegram/-8jI6AiqCmQgWrggXH9YLwpKKzzq7by02yxwbxJ-KYwNVwI...