CVE-2024-13971

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobsterpro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services...

CVE-2024-39847

CVE-2024-39847 describes an XXE-like weakness in the XML parser of the 4D Server SOAP endpoints. Unauthenticated attackers can read files on the application server and adjacent network shares, and can issue HTTP GET requests to arbitrary services. The connected documents confirm the vulnerability...

U-SPEED N300 资源管理错误漏洞

The U-SPEED N300 is a wireless router device produced by the U-SPEED company. The U-SPEED N300 V1.0.0 version has a resource management vulnerability. This vulnerability stems from a denial-of-service attack on the embedded Boa HTTP server. It is possible for attackers to exhaust system resources...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the reuse of an easy handle in HTTP requests when a custom Host: header is set for the initial request and omitted in a subsequent one. An attacker can obtain cookies intended for a different host by exploiti...

CVE-2026-31955

Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery SSRF vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS...

EUVD-2026-25366

Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request Forgery SSRF vulnerability in versions prior to 4.4.1 allows users with DataSet permissions to make arbitrary HTTP requests from the CMS...

Delta Electronics AS320T 安全漏洞

The Delta Electronics AS320T is a high-performance programmable logic controller device used for industrial automation control by Delta Electronics. There is a security vulnerability present in the Delta Electronics AS320T, which stems from an incorrect calculation of the stack buffer size in the...

CVE-2025-66286

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP request...

CVE-2026-4917

Technical details about CVE-2026-4917 are not publicly available in the provided documents. Monitor for updates as information is released.

HTTP Chunked Encoding Behavior Analyzer

This script is a security analysis tool designed to test how a web server such as Kestrel-based applications handles HTTP requests using chunked transfer encoding...

PowerDNS DNSdist和PowerDNS Authoritative 安全漏洞

PowerDNS DNSdist and PowerDNS Authoritative are both products of the PowerDNS company. PowerDNS DNSdist is a proxy software that provides DNS traffic load balancing and security protection capabilities. PowerDNS Authoritative is a DNS server software. Both PowerDNS DNSdist and PowerDNS...

PowerDNS DNSdist和PowerDNS Authoritative 安全漏洞

PowerDNS DNSdist and PowerDNS Authoritative are both products of the PowerDNS company. PowerDNS DNSdist is a proxy software that provides DNS traffic load balancing and security protection capabilities. PowerDNS Authoritative is a DNS server software. Both PowerDNS DNSdist and PowerDNS...

PowerDNS Recursor（pdns_recursor） 安全漏洞

PowerDNS Recursor pdnsrecursor is a domain name resolution server developed by the Dutch company PowerDNS. There is a security vulnerability in PowerDNS Recursor pdnsrecursor, which stems from the ability of attackers to send web requests, leading to unlimited memory allocation on internal web...

CVE-2026-41135

free5GC UDR is the Policy Control Function PCF for free5GC, an an open-source project for 5th generation 5G mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to the PCF SBI interface to cause uncontrolled memory...

Oracle Financial Services Analytical Applications Infrastructure 安全漏洞

Oracle Financial Services Analytical Applications Infrastructure is a financial data analysis and modeling platform developed by Oracle Corporation. Versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 of Oracle Financial Services Analytical Applications Infrastructure contain security vulnerabilities. These...

Oracle PeopleSoft Enterprise FIN Project Costing 安全漏洞

Oracle PeopleSoft Enterprise FIN Project Costing is a project cost management system developed by Oracle Corporation. Version 9.2 of Oracle PeopleSoft Enterprise FIN Project Costing contains a security vulnerability. This vulnerability stems from issues with the Projects component, which may allo...

Oracle PeopleSoft Enterprise SCM Purchasing 安全漏洞

Oracle PeopleSoft Enterprise SCM Purchasing is a procurement management system developed by Oracle Corporation. Version 9.2 of Oracle PeopleSoft Enterprise SCM Purchasing contains a security vulnerability. This vulnerability stems from issues with the Purchasing component, which may allow attacke...

GHSA-XMXX-7P24-H892 OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

Summary Gateway HTTP and WebSocket handlers captured the resolved bearer-auth configuration when the server started. After a SecretRef rotation, the already-running gateway could continue accepting the old bearer token until restart. Impact A bearer token that should have been revoked by SecretRe...

GHSA-45Q2-GJVG-7973 Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Impact A Server-Side Request Forgery SSRF vulnerability exists in @angular/platform-server due to improper handling of URLs during Server-Side Rendering SSR. When an attacker sends a request such as GET /\evil.com/ HTTP/1.1 the server engine Express, etc. passes the URL string to Angular’s...

SUSE-SU-2026:21206-1 Security update for LibVNCServer

This update for LibVNCServer fixes the following issues: - CVE-2026-32853: crafted FramebufferUpdate message can lead to information disclosure or denial of service bsc1260431. - CVE-2026-32854: crafted HTTP requests can cause a denial of service bsc1260429...