CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

EUVD-2026-43515

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

EEF-CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Summary Cross-site scripting vulnerability in phoenixframework phoenix\live\view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid\destination!/2 and Phoenix.LiveView.Utils.valid\live\navigation\destination!/2...

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-57795

creationtimestamp| type| source ---|---|--- 2026-07-13 18:02:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkbm5fcyv22 2026-07-16 08:04:27+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqrlsl2lh2g...

Malicious code in node-sysmon-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 612887c8528ff96b3bc3a61d678b6376099480c080d2d8a0960fe7798ac25f33 On module load, index.js reconstructs a hex-encoded URL Buffer.from'687474703a2f2f3135322e35332e3132302e39302f636d64','hex' that decodes to...

CVE-2026-13240

creationtimestamp| type| source ---|---|--- 2026-07-13 17:36:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqka5a775724...

CVE-2026-13237

creationtimestamp| type| source ---|---|--- 2026-07-13 17:34:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7zm334g2v...

CVE-2026-13236

creationtimestamp| type| source ---|---|--- 2026-07-13 17:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7w2sdkl2b 2026-07-21 04:45:08+00:00| seen| https://jvn.jp/en/jp/JVN20592637...

CVE-2026-13235

creationtimestamp| type| source ---|---|--- 2026-07-13 17:32:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqk7vzdsnp24...

GHSA-RWCV-WHM8-FMXM

creationtimestamp| type| source ---|---|--- 2026-07-13 17:11:49+00:00| seen| https://gist.github.com/alon710/1cf437e22a892172012205a9b0e24d57...

PYSEC-2026-2614 `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

lxmlhtmlclean.Cleaner does not strip javascript: URLs from namespaced URL attributes xlink:href Reporter: Guillem Lefait · Date: 2026-05-10 Affected: lxml ≤ 6.1.0 and lxmlhtmlclean ≤ 0.4.4 latest stable Confirmed against: lxml 6.1.0 + lxmlhtmlclean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8...

PYSEC-2026-3412 WeasyPrint has CSS Injection via Presentational Hints

Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input. Details File: weasyprint/css/init.py The...

PYSEC-2026-2481 flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf

Summary flyto-core's SSRF protection validateurlssrf / isprivateip in src/core/utils.py blocks private and metadata destinations by resolving the host and testing the resulting IP for membership in a hardcoded PRIVATEIPRANGES list. That list contains only the native RFC 1918 / loopback / link-loc...

LangGraph SDK has unsafe URL path construction

Summarylanggraph-sdk constructs HTTP request paths for resource operations by interpolating caller-supplied identifier values into URL templates. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to addres...

PYSEC-2026-2766 Open WebUI: Cross-user file disclosure via /api/chat/completions image_url field

summary POST /api/chat/completions accepts an imageurl.url value that, when it does NOT start with http://, https://, or data:image/, is interpreted as a file id and resolved against the global file table with no ownership check. An authenticated user can therefore set imageurl.url to another...

PYSEC-2026-2718 Open WebUI: Authenticated users can target arbitrary configured Ollama backends via unguarded url_idx path parameter

Summary Several direct, index-addressed Ollama proxy routes accept a caller-supplied urlidx path parameter and use it as a raw index into the admin-configured OLLAMABASEURLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the...

PYSEC-2026-2690 Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)

Summary backend/openwebui/utils/oauth.py::processpictureurl v0.9.5, lines 1435-1470 calls validateurlpictureurl on the initial URL only, then invokes aiohttp.ClientSession.getpictureurl, ... without allowredirects=False. aiohttp's default is allowredirects=True, maxredirects=10; the function does...

Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects

SummaryThe SafePlaywrightURLLoader implements a validateurl function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL.Since Playwright automatically follows HTTP redirects 301/302 by default, an attacker can...