Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
CVE-2026-84366
### Problem Scrapy’s `S3DownloadHandler` sends signed S3 requests over plaintext HTTP by default. A normal request lik
#cwe-319
共收录 141 条相关情报。
← 返回所有主题HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_as...
CVE-2026-84381
HTTPX2 是一个为 Python 设计的下一代 HTTP 客户端，其底层网络库 httpcore2 在版本 2.10.0 之前存在一个安全缺陷：当远程源使用 wss:// 并通过 SOCKS5 代理连接时，由于 TLS 升级条件仅识别
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
CVE-2026-84381
HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpc
Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-schem...
CVE-2026-84366
Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handle
A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Successful exploitatio...
CVE-2026-73756
A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive informati
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
CVE-2026-84366
Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handle
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by ...
CVE-2026-73743
A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated r
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
## Summary pnpm expands `${VAR}` environment placeholders in the `httpProxy` / `httpsProxy` / `noProxy` settings read f
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authenticatio...
CVE-2026-55860
MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2db
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be ...
CVE-2026-55857
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js...
CVE-2026-55854
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
CVE-2026-55860
### Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile o
org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
CVE-2026-55857
### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
CVE-2026-55854
### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAut...
CVE-2026-81836
A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file sr
A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive co...
CVE-2026-73809
A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web manag
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation...
CVE-2026-69658
MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level atta
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attacke...
CVE-2026-81691
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the cl...
CVE-2026-19854
When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connecti
openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs
CVE-2026-81691
openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting