112836 matches found
CVE-2026-82249
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...
CVE-2026-82249
gitoxide before 0.38.2 is vulnerable to a credential helper protocol field injection . The root cause is the failure to validate carriage return characters in URL values passed to credential helpers. An attacker can supply URLs containing bare carriage returns to inject additional protocol fields...
CVE-2026-82249 gitoxide before 0.38.2 Credential Helper Protocol Field Injection
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...
CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
CVE-2026-82247
CVE-2026-82247 affects the gix-url crate (≤ 0.32.0) within the gitoxide Rust library. Its hand-rolled URL parser fails to treat ? or # as authority terminators per RFC 3986 , causing gix-transport 's HTTP redirect identity guard (can_reuse_identity) to compare the wrong host and fail open . An at...
CVE-2026-82247
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
CVE-2026-82247 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
EUVD-2026-67699
gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1...
EUVD-2026-67698
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...
CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...
CVE-2026-82246
Budibase Server before 3.41.3 is affected by a server-side request forgery (SSRF) vulnerability in the query import endpoint . The root cause is the failure to validate user-supplied URLs before fetching content, allowing authenticated attackers to submit arbitrary URLs and retrieve responses fro...
CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...
SUSE CVE-2024-29180
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...
CVE-2026-78615
A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...
SUSE CVE-2026-55677
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...
CVE-2026-54330
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...
CVE-2026-37710
Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...
CVE-2026-37710
CVE-2026-37710 is a cross-site scripting (XSS) vulnerability in Omeka S v.4.2.0 , triggered through the site navigation custom URL function , allowing a remote attacker to execute arbitrary code with user interaction. The CNA-assigned CVSS 3.1 score is 6.1 (Medium) with a changed scope, reflectin...
CVE-2026-50979
A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...