PT-2026-58068

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0 Description An issue exists where the Caldav::connect to server function in application/controllers/Caldav.php processes the caldav url variable without validating the scheme or host. This allows an...

Apache Tomcat 10.1.0.M1 < 10.1.57 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.57. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.57security-10 advisory. - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to...

CVE-2026-59083: Improper Handling of URL Encoding (Hex Encoding)

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

Apache Tomcat 11.0.0.M1 < 11.0.24 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.24. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.24security-11 advisory. - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to...

SIP Sustainable Irrigation Platform 5.x (nr-url) Blind SSRF

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

vitest: Vitest: Arbitrary code execution via crafted browser-runner URL

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the...

CVE-2026-55475

creationtimestamp| type| source ---|---|--- 2026-07-13 23:24:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktlkikqr2d...

CVE-2026-55404

creationtimestamp| type| source ---|---|--- 2026-07-13 23:21:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktfz7kmj2d 2026-07-14 08:07:20+00:00| seen| https://gist.github.com/akib-h/a603a4aaf4aab24ac683c30e9a2ad670 2026-07-16 16:25:05+00:00| seen|...

CVE-2026-62195

creationtimestamp| type| source ---|---|--- 2026-07-13 23:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkt4djxzu2i 2026-07-15 09:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqoemwbh6j2f...

CVE-2026-62199

creationtimestamp| type| source ---|---|--- 2026-07-13 22:56:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrznklv22l 2026-07-15 10:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqohy7pg2g26...

CVE-2026-61458

creationtimestamp| type| source ---|---|--- 2026-07-13 22:50:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrqbq6nf2g...

Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URL fetch logic in the scraping loaders and website scraping tools, including DocsSiteLoader, DOCXLoader, PDFLoader, loadfromurl,...

CVE-2026-57800

creationtimestamp| type| source ---|---|--- 2026-07-13 22:18:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkpvxla5u2d 2026-07-16 08:11:51+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqryzkfi72p...

CVE-2026-62242

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-15595

creationtimestamp| type| source ---|---|--- 2026-07-13 22:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkpr2dip426...

CVE-2026-58410

creationtimestamp| type| source ---|---|--- 2026-07-13 22:01:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkoxhvhd42i...

CVE-2026-12536

creationtimestamp| type| source ---|---|--- 2026-07-13 21:41:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqknu2mb5q2x...

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...