122902 matches found
CVE-2026-58469
A flaw was found in GNU Wget. A malicious server could exploit a heap buffer underread vulnerability by providing a specially crafted Metalink document containing a URL with only whitespace characters. This could lead to memory corruption and abnormal program behavior, potentially causing a denia...
Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-848m-r628-vrxw. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing...
GHSA-3F6W-45Q9-V69M Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-848m-r628-vrxw. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing...
CVE-2026-15813
creationtimestamp| type| source ---|---|--- 2026-07-20 11:55:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3aexvnnd23...
CVE-2026-13147
creationtimestamp| type| source ---|---|--- 2026-07-20 08:45:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2vq6jhwj22 2026-07-20 14:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3ivhsis32s...
CVE-2026-2445
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...
CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...
EUVD-2026-45898
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...
CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...
CVE-2026-2445
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...
CVE-2026-6656
creationtimestamp| type| source ---|---|--- 2026-07-20 08:02:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2td52ent2i 2026-07-20 17:24:51+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr3srkvkx32n...
CVE-2026-10755
creationtimestamp| type| source ---|---|--- 2026-07-20 07:56:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2t24q7et2q...
CVE-2026-13147
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts Server-Side Request Forgery...
CVE-2026-13147
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts Server-Side Request Forgery...
CVE-2026-12606
creationtimestamp| type| source ---|---|--- 2026-07-20 05:19:29+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mr2kaioqa522...
PT-2026-67319
Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.14.2 Description The built-in cURL handlers CurlHandler and CurlMultiHandler fail to properly isolate Proxy-Authorization headers from origin servers. This occurs because the handlers place first-class...
CVE-2026-2445: Improper Neutralization of Input During Web Page Generation
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...
PT-2026-61735
Name of the Vulnerable Software and Affected Versions GRAPHIFY versions 0.3.2 through 0.4.29 Description A remote attacker can execute arbitrary code through the validate url, safe fetch, build opener, fetch html, and download binary functions. Recommendations At the moment, there is no informati...
CVE-2026-32824: URL Redirection to Untrusted Site
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and...
CVE-2026-44583: Server-Side Request Forgery (SSRF)
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...