PT-2026-66760

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.6.1 Description An open redirect issue exists in the 'exit.php' endpoint. Unauthenticated attackers can redirect users to arbitrary external sites by providing a malicious Base64-encoded url parameter. This occu...

CVE-2026-53573: URL Redirection to Untrusted Site

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This...

The vulnerability of React Router’s routing library in React applications stems from the redirection of URLs to unreliable websites, allowing attackers to carry out phishing attacks.

The vulnerability of the React Router routing library for React applications relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a remote attacker to carry out phishing attacks...

Linux Distros Unpatched Vulnerability : CVE-2026-18446

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based...

openSUSE 16 Security Update : libkrun (openSUSE-SU-2026:21464-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21464-1 advisory. - CVE-2025-24898: openssl: use-after-free in ssl::selectnextproto due to improper lifetime handling bsc1270429. - CVE-2026-41676: openssl: short...

CVE-2026-55768

creationtimestamp| type| source ---|---|--- 2026-07-30 22:44:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/i756bnxfs3slr...

CVE-2026-11536

creationtimestamp| type| source ---|---|--- 2026-07-30 22:16:19+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrvhpxhewy2y 2026-08-06 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgbdb2yns2v...

CVE-2026-67530

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...

CVE-2026-14602

creationtimestamp| type| source ---|---|--- 2026-07-30 20:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrva4fhjpv2v 2026-08-06 20:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msgu7ogxhb2c...

CVE-2026-64870

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

CVE-2026-15974

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...

CVE-2026-66756

creationtimestamp| type| source ---|---|--- 2026-07-30 18:13:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/cv5imuadgzan6...

CVE-2026-15974 CVE-2026-15974

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...

EUVD-2026-51263

SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...

CVE-2026-15974

SGLang , an open-source framework for serving large language models, contains a Server-Side Request Forgery (SSRF) and local file read vulnerability in the multimodal generation endpoint /v1/chat/completions. The root cause is the lack of sanitization for the image_url input, which allows an atta...

CVE-2026-67174

creationtimestamp| type| source ---|---|--- 2026-07-30 17:48:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruyqccvhz2e...

CVE-2026-66414

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl...

CVE-2026-54722

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...

EUVD-2026-51201

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

CVE-2026-64870 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...