Unauthorized SSRF in InsForge enables internal network probing and credential leakage
An attacker can abuse Express's URL-parameter decoding by crafting a slug that contains a double slash (for example `%2F%2F169.254.169.254`), bypass the original-host restriction, and issue arbitrary HTTP requests. Because the route has no authentication middleware and by default forwards sensitive headers such as Authorization, an unauthenticated attacker can reach cloud metadata, databases, and other internal services, leading to serious information disclosure and potential lateral movement.
Component
InsForge is a backend service component built on Node.js and the Express framework. Its core role is handling function-route requests and acting as a proxy that forwards data. It aims to provide a unified API for communication between external clients and internal backend services, supporting dynamic path matching and request-header passthrough to improve resource scheduling and service invocation in distributed systems.
Strictly validate the slug format before building the target URL and allow only characters that match a predefined grammar. Enforce same-origin checks so redirect targets stay on the base domain, and require authentication on sensitive operation paths to block unauthorized request forwarding.
CSSA Exclusive Early Warning
10.0 Critical
Missing authentication on the gost API service enables remote privilege abuse and system misuse
An attacker can take advantage of default startup parameters that do not embed user credentials and directly reach the exposed API port. When no explicit authentication is configured, the middleware is inactive, so any network-reachable attacker can create, modify, or delete proxy services without restriction, turn the host into an open relay, or disrupt service, seriously harming confidentiality and integrity.
Component
gost is a multi-protocol network proxy tool written in Go. It supports HTTP, SOCKS5, and chained proxy architectures. Its core role is building flexible forwarding paths and traffic handling so developers and operators can deploy lightweight, efficient network debugging, tunneling, and proxy services.
Type
Missing Authentication for Critical Function (CWE-306)
When using the API service, always specify a URL that includes a username and password to enable basic authentication, and combine that with firewall rules that strictly limit which sources can reach the API port; do not expose it to the public internet.
CVE Intelligence
2
CVE-2026-89035
CVSS
10.0 Critical
2026-10-22
Remote code execution in Microsoft Exchange Server via crafted HTTP requests
In Microsoft Exchange Server, a flaw in how certain HTTP requests are handled allows an attacker to send crafted HTTP requests and execute arbitrary code without authentication. The vulnerability lets the attacker abuse that flaw to run arbitrary code and threaten server stability and security. Microsoft Exchange Server has a security defect when processing specific HTTP request scenarios; an attacker can trigger it with a malicious request, leading to remote code execution or service disruption. All unpatched Microsoft Exchange Server users are affected, including enterprise mail-server deployments. An attacker only needs to send a crafted HTTP request; no authentication is required and the attack can be carried out remotely.
Component
Microsoft Exchange Server is enterprise mail and collaboration server software that supports mail transport, calendar sharing, and team collaboration.
Risks
From ordinary user to administrator: If the server is misconfigured or the attacker escalates privileges through the vulnerability, the attacker can obtain system administrator privileges
Complete system control: An attacker can exploit this vulnerability to execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
Unauthenticated attack: An attacker needs no credentials to trigger the vulnerability remotely and attack the server directly
Enable network isolation and access-control mechanisms for Exchange Server
Block crafted HTTP requests from untrusted sources
CVE-2026-110264
CVSS
10.0 Critical
2026-10-22
Integer overflow in GitLab regular-expression compilation leads to remote code execution
In all GitLab CE/EE versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, a serious security flaw exists because an integer overflow (CWE-190) occurs when compiling a carefully crafted regular expression. Under certain conditions, an unauthenticated user can exploit this vulnerability to execute arbitrary code on the GitLab server. All GitLab instances that have not been updated to the listed security versions are affected, including Community Edition (CE) and Enterprise Edition (EE). An attacker needs no authentication to attack remotely: by sending a crafted regular-expression request that triggers the integer overflow, the attacker can achieve remote code execution and fully control the server.
Component
GitLab is an open-source DevOps platform based on Ruby on Rails that provides code hosting, CI/CD, and project management, and is widely used in enterprise software development workflows.
Risks
Complete system control: An attacker can exploit this vulnerability to execute arbitrary code on the GitLab server, obtain the highest privileges on the server, and thereby control the entire GitLab instance and its underlying operating system
Unauthenticated attack: An attacker needs no credentials; the attack surface is large, and any user who can reach the GitLab network interface can attempt exploitation
Data leakage and tampering: An attacker can read, modify, or delete source code, secrets, configuration, and other sensitive data stored in projects
Service disruption: An attacker may use malicious code to crash the service or cause denial of service, disrupting the development team's normal workflow
Immediately upgrade GitLab CE/EE to 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, or 19.5.1 or later
If an immediate upgrade is not possible, restrict network access to the GitLab instance and allow only trusted IP addresses
Deploy a web application firewall (WAF) to block requests that contain abnormally complex or overly long regular expressions
Monitor server logs for anomalous process creation or resource consumption so potential intrusions can be detected promptly
Package Poisoning
8
Package Poisoning
gem2026-10-22
zzhelloworld_socktest@0.2.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
460645827ee078f361385547df90731d
Package Poisoning
npm2026-10-22
@sudobility/wildduck_client@2.3.102
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
55953e8f60f14008a042a9d0c28789f0
Package Poisoning
PyPI2026-10-22
iterquarry@2.2.1
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
dda37aea89f95c929c896ea4560a7696
Package Poisoning
PyPI2026-10-22
libseal@1.1.3
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
85e7ab6cecf9e7c671477531e34496db
Package Poisoning
PyPI2026-10-22
orchestril@0.1.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
aaa929ce9f6bdb2766325bd3b7f24417
Package Poisoning
PyPI2026-10-22
phonoviatts@0.1.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
bc86b57126bfd831da3cab9282449382
Package Poisoning
pypi2026-10-22
quillonatts@0.1.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
71277aa914a4a9ecd2d7b4384248bb28
Package Poisoning
PyPI2026-10-22
shellgrip@0.1.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
