CVE-2026-59227

creationtimestamp| type| source ---|---|--- 2026-07-10 05:30:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbg6ejpes22 2026-07-24 18:35:17+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-rqj7-6wrp-6g2g...

CVE-2026-15331

A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function addurl/addpackage of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path traversal. The attack may be initiated...

CVE-2026-15282

creationtimestamp| type| source ---|---|--- 2026-07-10 05:16:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbffamohv2z 2026-07-11 00:00:32+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqde7qogx42j 2026-07-13 01:01:18+00:00| seen|...

CVE-2026-15284

The King Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formpageid' parameter in versions up to, and including, 51.1.62 This is due to insufficient input sanitization in the addtosubmissions function, which applies sanitizetextfield which preserves...

CVE-2026-55616

creationtimestamp| type| source ---|---|--- 2026-07-10 04:07:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqbbkbvc622t...

SUSE CVE-2026-8926

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a username without a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is n...

SUSE CVE-2026-12064

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

SUSE CVE-2026-58501

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...

SUSE CVE-2026-59947

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-59858

creationtimestamp| type| source ---|---|--- 2026-07-10 00:40:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqavxyae4f2l 2026-07-10 19:54:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcwikfmx22a 2026-07-11 01:45:18+00:00| seen|...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution when the gh codespace jupyter process opens a JupyterLab URL supplied by a process inside a Codespace without validating that it is a loopback HTTP or HTTPS address. An attacker can execute arbitrary command...

GHSA-H74C-Q9J7-MPCM Tesla vulnerable to atom exhaustion via untrusted URL scheme

Summary In the Mint adapter for the Tesla HTTP client library, Tesla.Adapter.Mint.openconn/2 passes the URL scheme of every outgoing request through String.toatom/1 with no allow-list validation. Because BEAM atoms are permanent never garbage-collected and the atom table is bounded at roughly...

CVE-2026-55490

creationtimestamp| type| source ---|---|--- 2026-07-10 00:02:34+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mqatulwmip2n...

CVE-2026-55461: URL Redirection to Untrusted Site

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url-previous from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect-intended... when redirectoption=back is submitted, allowing Snipe-IT to be used a...

CVE-2026-57575: Server-Side Request Forgery (SSRF)

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery SSRF vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can...

CVE-2026-29519: Improper Neutralization of Input During Web Page Generation

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

CVE-2026-55665: Improper Neutralization of Input During Web Page Generation

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, Grist contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, so a javascript URL could run in a victim's Grist origin on a single...

CVE-2026-55806: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11.0., from 0.0.0 to 11.1...

CVE-2026-55671: Server-Side Request Forgery (SSRF)

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

PT-2026-57190

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.78 Description An unauthenticated server-side request forgery SSRF exists in the Jobs API endpoint '/api/v1/runs'. The issue occurs because the webhook url parameter is validated during the initial request but...