Publikacje w kolejności czasu

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL()…

CVSS 3,7 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked…

CVSS 6,3 · EPSS 0,25 % · rekomendacja wg zapisanej polityki

Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud…

CVSS 2,3 · EPSS 0,18 % · rekomendacja wg zapisanej polityki

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1.

CVSS 2,4 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when…

CVSS 6,5 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad2368a and prior, two React components render externally-sourced strings directly as HTML using dangerouslySetInnerHTML, with no sanitization (the project has no DOMPurify or equivalent dependency).…

CVSS 4,6 · EPSS 0,16 % · rekomendacja wg zapisanej polityki

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign,…

CVSS 8,7 · EPSS 0,47 % · rekomendacja wg zapisanej polityki

@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal…

CVSS 8,9 · EPSS 0,44 % · rekomendacja wg zapisanej polityki

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load…

CVSS 2,3 · EPSS 0,32 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.

CVSS 9,8 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0.

CVSS 7,1 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.

CVSS 7,1 · EPSS 0,19 % · rekomendacja wg zapisanej polityki

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1.

CVSS 8,1 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

CVSS 9,8 · EPSS 0,31 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

CVSS 8,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.

CVSS 9,8 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregisters the notifiers and then releases…

Ocena niepełna · brak pełnych danych nie oznacza niskiego ryzyka