122664 matches found
CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72591
A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...
CVE-2026-72581
CVE-2026-72581 describes a server-side request forgery in duhow/xiaoai-patch introduced by commit fb07049. The /auth endpoint in api/main.py uses a user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling an attacker to cause the X...
EUVD-2026-55232
A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...
CVE-2026-71392
creationtimestamp| type| source ---|---|--- 2026-08-10 10:39:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/enijmvsyiaud2 2026-08-10 12:45:15+00:00| seen| https://cert.pl/en/posts/2026/08/CVE-2026-71391...
CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...
CVE-2026-61899 Apache Tapestry: Possible classpath file download through URL manipulation
Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue...
CVE-2026-44102
creationtimestamp| type| source ---|---|--- 2026-08-10 10:30:06+00:00| seen| https://bsky.app/profile/cvedatabase.bsky.social/post/3mspvfaxfz72c...
CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter
Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter
Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-40920
Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-40920 Apache Ranger: Privilege Escalation via URL Parameter
Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
EUVD-2026-55252
Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-42537
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-42537
Apache Ranger versions prior to 2.9.0 (
CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
EUVD-2026-55251
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-42537 Apache Ranger: Remote Code Execution via JDBC URL Injection
Remote Code Execution via JDBC URL Injection in Apache Ranger = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...
CVE-2026-66688
creationtimestamp| type| source ---|---|--- 2026-08-10 10:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspumcjnfd2w 2026-08-11 06:16:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msrxo23v5r2w...