Symfony - Authentication Bypass Detection

Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including 1 no hash or 2 an invalid has...

WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting Detection

WordPress Embed Swagger plugin 1.0.0 and prior contains a reflected cross-site scripting vulnerability due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file, which allows attackers to inject arbitrary web scripts onto the page...

CVE-2026-14167

creationtimestamp| type| source ---|---|--- 2026-07-28 09:10:33+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mrp2uww2wo32 2026-07-28 11:32:01+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrpcrz7cxf2p...

EUVD-2026-49731

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

CVE-2026-11756

creationtimestamp| type| source ---|---|--- 2026-07-28 08:30:53+00:00| seen| https://bsky.app/profile/suriq.io/post/3mroyo3n2wp23 2026-07-28 14:16:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrplxdruzy24...

CVE-2026-15136

creationtimestamp| type| source ---|---|--- 2026-07-28 08:20:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mroy447cmm2s...

CVE-2026-65438

creationtimestamp| type| source ---|---|--- 2026-07-28 00:34:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mro5zt6dyj2i...

CVE-2026-65442

creationtimestamp| type| source ---|---|--- 2026-07-28 00:29:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mro5s5l3hl2s...

CVE-2026-65439

creationtimestamp| type| source ---|---|--- 2026-07-28 00:22:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mro5fhjm5z2g 2026-07-28 14:05:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrple3oeuj2z...

CVE-2026-55685

creationtimestamp| type| source ---|---|--- 2026-07-28 00:12:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mro4sldjp72o 2026-08-05 19:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mse7x4p7ls2y 2026-08-05 19:07:07+00:00| seen|...

CVE-2026-65437

creationtimestamp| type| source ---|---|--- 2026-07-28 00:10:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mro4oqccbi27...

EUVD-2026-49865

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the URL path concatenation and encoding module. The application splices untrusted extension path and attacker-controlled query string into a path buffer, then invokes urlencode without validating the final string...

CVE-2026-14171: URL Redirection to Untrusted Site

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

ROS-20260728-73-0010

The vulnerability of the Jolokia application programming interface of the Apache ActiveMQ messaging broker is related to deficiencies in the code generation management mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a configuration XML file...

PT-2026-65524

Name of the Vulnerable Software and Affected Versions Rouille versions 0.1.6 through 3.6.2 Description A reachable assertion issue exists in the Request::remove prefix function. Remote unauthenticated attackers can cause a server crash or a 500 error by sending a specially crafted percent-encoded...

PT-2026-65480

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

CVE-2026-65882: Improper Neutralization of Input During Web Page Generation

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector...

PT-2026-65688

Name of the Vulnerable Software and Affected Versions Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … version 10.8.7 Description An authentication bypass exists due to a hardcoded backdoor. The arve uc init function, which executes before authentication checks on eve...

CVE-2026-66754: Reachable Assertion

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...

PT-2026-65626

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The sendFile function in the httpserver/handler.go file incorrectly derives the authorization filename from the raw req.URL.Path while opening the file using a cleaned path. This discrepancy allows an...