Search Vulnerabilities

Cluster-proxy: cluster-proxy: impersonation header injection in service-proxy grants cluster-admin on every managed cluster

Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs

MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters

Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision

Better Auth: Unauthorized invitation acceptance via unverified email match in organization plugin

Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration

Input Validation Vulnerabilities in Snowflake Spark Connector

9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs

Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an act...

Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTT...

NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint

Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration

PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes

Unintended Proxy or Intermediary ('Confused Deputy') in GitLab