CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

EUVD-2026-67767

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

openSUSE 16 Security Update : python-pip (openSUSE-SU-2026:21643-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21643-1 advisory. This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows...

FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory. Composer project reports: Validate package bin paths against path traversal using symlinks...

CVE-2026-51647: Improper Access Control

Incorrect access control in the getCrpcCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud remote-control status and URL information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82247: Insufficiently Protected Credentials

gitoxide's gix-url crate = 0.32.0, fixed in 0.37.1 uses a hand-rolled URL parser that does not treat '?' or '' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard canreuseidentity compares the wrong host and fails open. An...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

PT-2026-83286

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

PT-2026-83099

Name of the Vulnerable Software and Affected Versions gix-url versions prior to 0.37.1 gix-transport versions prior to 0.58.1 Description The gix-url crate employs a custom URL parser that fails to treat '?' or '' as terminators for the authority component, violating RFC 3986. This leads to a...

PT-2026-83101

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

PT-2026-83134

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-37237

The vLLM library (up to and including version 0.17.0 ) is vulnerable to a Denial of Service (DoS) via memory exhaustion. The root cause lies in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions within multimodal/inputs.py. These functions utilize the aiohttp library to fetch use...

PT-2026-83098

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

CVE-2026-50979

Osbil Technology oPanel (v1.19.50 and earlier) contains a command injection vulnerability in the /advanced/curl endpoint. The flaw exists because the application fails to properly sanitize user input provided to the url parameter before passing it to the underlying system curl routine. An authent...

PT-2026-83344

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...

PT-2026-83125

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-82181: Use of GET Request Method With Sensitive Query Strings

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

CVE-2026-55834: URL Redirection to Untrusted Site

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...

CVE-2026-50979: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...