CVE-2026-63408 Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

EUVD-2026-62547

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints...

CVE-2026-76203

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...

CVE-2026-76203

Pentestify (a penetration testing report tool by maalfer) versions 1.2.0 through 2.3.2 contain a CSS sanitizer bypass in the report theme feature. The root cause is an Incorrect Behavior Order: Validate Before Canonicalize flaw — the sanitizer checks CSS input before resolving hex escape sequence...

EUVD-2026-62416

Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address and User-Agent, via CSS hex escapes that...

CVE-2026-76225 ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP

A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP SSH File Transfer Protocol or SCP Secure Copy Protocol as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect t...

BIT-GOLANG-2026-56860 Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

Malicious code in ambera (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625 The package presents itself as a zero-dependency SVG helper, but its exported getPlugin function performs an HTTPS GET to the hardcoded host...

MAL-2026-14197 Malicious code in twapfetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables...

Malicious code in tailwind-utility-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to...

PT-2026-78531

Name of the Vulnerable Software and Affected Versions keeper.sh calendar module versions prior to 2.18.14 Description An authenticated attacker can bypass the server-side request forgery SSRF guard to access private network addresses. This is achieved through a DNS rebinding attack targeting the...

PT-2026-78547

Name of the Vulnerable Software and Affected Versions Multicluster Engine for Kubernetes affected versions not specified Description A flaw in the cluster-proxy-addon component allows an unauthenticated attacker with access to the user-facing route to bypass authentication and authorization check...

PT-2026-78811

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archive password parameter is not...

PT-2026-78730

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.10 Splunk Secure Gateway...

PT-2026-80303

Ref: https://github.com/ihor-sokoliuk/mcp-searxng/issues/87issuecomment-4645453694 Summary The web url read tool fetches a caller-supplied URL server-side and converts it to markdown. An SSRF guard assertUrlAllowed, which blocks private/loopback/metadata addresses exists but runs only when MCP HT...

ROS-20260819-73-0062

The vulnerability in Tomcat is related to incorrect processing of data with URL encoding. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

ROS-20260819-73-0063

The vulnerability in Tomcat10 is related to incorrect processing of data with URL encoding. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

ROS-20260819-73-0064

The vulnerability in Tomcat11 is related to incorrect processing of data with URL encoding. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

CVE-2026-53654: URL Redirection to Untrusted Site

Grav is a file-based Web platform. Prior to 3.8.5, the Login plugin twofacancel task accepts a client-controlled redirect field without a nonce and allows an unauthenticated request to set an external http, https, or protocol-relative Location target. Controller::execute applies the field when...