CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...

CVE-2026-13765

creationtimestamp| type| source ---|---|--- 2026-07-19 14:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqywv26hkv2o...

CVE-2026-53376

creationtimestamp| type| source ---|---|--- 2026-07-19 12:11:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqyqt2icze23 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

OESA-2026-2987 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or...

CVE-2026-16220

creationtimestamp| type| source ---|---|--- 2026-07-19 08:39:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqyewzht452i...

CVE-2026-16155

creationtimestamp| type| source ---|---|--- 2026-07-18 23:49:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqxhcsx4ri2x...

CVE-2026-16194

CVE-2026-16194 affects zhayujie CowAgent (up to 2.1.1). The issue is in WebFetch.execute (agent/tools/web_fetch/web_fetch.py): manipulating the url parameter can trigger a server-side request forgery. The attack is described as remote; a fix is available in version 2.1.2 (commit ea47f3097eed4f829...

CVE-2026-16131

creationtimestamp| type| source ---|---|--- 2026-07-18 20:24:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqx3vno4vo23...

CVE-2026-16130

creationtimestamp| type| source ---|---|--- 2026-07-18 20:04:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqx2rtevd62e...

Server-Side Request Forgery (SSRF)

Koel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of IPv6 transition addresses in the outbound URL guard, which allows an attacker to bypass SSRF protections and access internal services or cloud metadata endpoints through a malicious RSS feed...

CVE-2026-62857

creationtimestamp| type| source ---|---|--- 2026-07-18 17:38:21+00:00| seen| https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mqwslocjbbu2 2026-07-19 04:53:12+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d...

CVE-2026-16125

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely...

CVE-2025-71393

creationtimestamp| type| source ---|---|--- 2026-07-18 16:00:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwn4fqmqk2a...

CVE-2026-16127

The CVE-2026-16127 entry describes a vulnerability in zevorn rt-claw (up to version 0.2.0) affecting the http_request component, specifically claw_net_get and claw_net_post in claw/tools/tool_net.c. The issue arises from manipulation of the url argument, enabling server-side request forgery (SSRF...

CVE-2026-16127 zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

EUVD-2026-45388

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

CVE-2026-16127 zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

CVE-2025-71396

creationtimestamp| type| source ---|---|--- 2026-07-18 15:57:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwmyb5u6r2a...

CVE-2026-16125 zevorn rt-claw http_request net.c claw_net_post server-side request forgery

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...