122884 matches found
Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matching
Summary The administrator-configured WEBFETCHFILTERLIST the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch matches hostnames incorrectly, so the filter can be bypassed. Details isstringallowed backend/openwebui/utils/misc.py match...
CVE-2026-57530
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...
CVE-2026-52439
creationtimestamp| type| source ---|---|--- 2026-07-24 20:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg63tlg4j2y...
CVE-2026-48021
creationtimestamp| type| source ---|---|--- 2026-07-24 19:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrg3jmp2rf2y 2026-07-24 20:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrg5dtc5uh2a 2026-07-25 03:00:27+00:00| seen|...
Weblate: SSRF via URL Parser Differential in `normalize_request_url` (wlc)
The Weblate CLI client wlc was found to be vulnerable to Server-Side Request Forgery SSRF due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalizerequesturl function, which was meant to validate that outgoing API requests stayed...
CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...
CVE-2026-57530 Milkdown < 7.21.3 Stored XSS via javascript: URL in link href
Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components packages that allows attackers with document write access to execute arbitrary JavaScript in the browser context of any user who opens the document or clicks a...
CVE-2026-8789
creationtimestamp| type| source ---|---|--- 2026-07-24 17:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrftciba3h2q...
SUSE CVE-2026-5160
Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting XSS due to improper ordering of URL validation and normalization. The renderer validates link destinations using a prefix-based check IsDangerousURL before resolving HTML entities...
GHSA-38HQ-7X33-PHP4 @backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
Impact The allowlist matching used by the experimental dynamic client registration and client ID metadata document CIMD features in @backstage/plugin-auth-backend matched glob patterns against the full URL string. A wildcard could therefore match across URL component boundaries: a pattern such as...
CVE-2026-53402
creationtimestamp| type| source ---|---|--- 2026-07-24 13:25:25+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhb3ikw42o 2026-08-06 04:46:30+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-15 12:46:43+00:00|...
CVE-2026-63317
creationtimestamp| type| source ---|---|--- 2026-07-24 12:53:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrffhds5hm2d...
CVE-2026-15810
A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...
OESA-2026-3171 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like...
OESA-2026-3142 tomcat security update
Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Handling of URL Encodi...
CVE-2026-15810
A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...
CVE-2026-15810 Cross-Site Scripting (XSS) in Looker allows Admin Account Takeover
A Cross-Site Scripting XSS vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 on Looker-hosted and Self-hosted allows an attacker to execute arbitrary JavaScript leading to administrative account takeover using a...
CVE-2026-7483
creationtimestamp| type| source ---|---|--- 2026-07-24 10:15:43+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrf4nvc42o2v 2026-07-24 13:25:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mrfhaohidj2g 2026-07-25 08:08:14+00:00| seen|...
CVE-2026-12981
creationtimestamp| type| source ---|---|--- 2026-07-24 07:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116973779458861264 2026-07-24 07:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mretgfvnq42h 2026-07-24 21:52:27+00:00| seen|...