69 matches found
CVE-2023-41898_Lab
CVE-2023-41898 Unvalidated Deep Link Lab This is an educational, reduced-scope reproduction Lab built based on the public vulnerability report GHSL-2023-142 for Home Assistant Companion for Android and the open-source structure of the vulnerable version 2023.8.2. It does not use a real Home...
EUVD-2026-60058
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...
CVE-2026-22072
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...
CVE-2026-22072
CVE-2026-22072 involves arbitrary URL loading in WebView, where loading external URLs can permit malicious JavaScript to steal user tokens. The connected document confirms the issue arises from WebView behavior, enabling token leakage with a CVSS v4.0 base score of 8.3 (HIGH), attack vector Netwo...
CVE-2026-22072 Arbitrary URL Loading in WebView Leading to Token Leakage Risk
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...
CVE-2026-22072 Arbitrary URL Loading in WebView Leading to Token Leakage Risk
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...
PT-2026-73214
Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...
CVE-2025-15509
The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage...
CVE-2025-15509
CVE-2025-15509 affects the SmartRemote module, which has insufficient restrictions on loading URLs, potentially leaking information. CVSSv4.0 vector: AV:N/AC:L/PR:N/UI:P/HI:HIGH/VI:L; base score 7.1 (HIGH). Attack vector: network, no authentication, passive user interaction. No explicit remediati...
CVE-2025-15509: Missing Authentication for Critical Function
The SmartRemote module has insufficient restrictions on loading URLs, which may lead to some information leakage...
CVE-2026-24779 vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`
vLLM is an inference and serving engine for large language models LLMs. Prior to version 0.14.1, a Server-Side Request Forgery SSRF vulnerability exists in the MediaConnector class within the vLLM project's multimodal feature set. The loadfromurl and loadfromurlasync methods obtain and process...
PT-2026-5029
Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.14.1 Description A Server-Side Request Forgery SSRF exists in the MediaConnector class within the multimodal feature set. The load from url and load from url async functions process media from user-provided URLs using...
MiracleLinux 8 : java-1.8.0-openjdk-1.8.0.362.b09-2.el8 (AXSA:2023-4869:03)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4869:03 advisory. OpenJDK: improper restrictions in CORBA deserialization Serialization, 8285021 CVE-2023-21830 OpenJDK: soundbank URL remote loading Sound, 8293742...
MiracleLinux 8 : java-17-openjdk-17.0.6.0.10-3.el8 (AXSA:2023-4811:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4811:01 advisory. OpenJDK: handshake DoS attack against DTLS connections JSSE, 8287411 CVE-2023-21835 OpenJDK: soundbank URL remote loading Sound, 8293742...
EUVD-2014-1945
Malware in sbrugna...
EUVD-2024-51399
Malicious code in bioql PyPI...
EUVD-2022-29678
Malicious code in bioql PyPI...
EUVD-2024-51408
Malicious code in bioql PyPI...