CVE-2026-56778

creationtimestamp| type| source ---|---|--- 2026-07-08 15:53:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5i3z3kwf2q...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2024-30326

creationtimestamp| type| source ---|---|--- 2026-07-08 15:42:47+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/116885118437929306...

CVE-2026-54423

creationtimestamp| type| source ---|---|--- 2026-07-08 15:30:34+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mq5gs5iuht24 2026-07-10 05:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqbeizh3yj2c 2026-07-10 05:41:51+00:00| seen|...

CVE-2026-24698

creationtimestamp| type| source ---|---|--- 2026-07-08 15:20:36+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116885031205203938 2026-07-08 18:07:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5pkgwrsc26...

CVE-2026-14967

BBOT’s github_workflows module has a path-traversal vulnerability: the path-containment check fails to resolve ‘..’, allowing a crafted CODE_REPOSITORY URL to traverse out of the configured output directory. The write is bounded to two directory levels above the output location and the target is ...

CVE-2026-59703

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file://...

CVE-2026-59703 repomix - Local File Inclusion via file:// URL Scheme in Git Clone Endpoint

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file://...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the testConnection API when a malicious H2 JDBC URL is supplied, which leverages the H2 INIT parameter. An attacker can execute arbitrary Java code on the server by sending a crafted request to the API...

CVE-2019-10663

creationtimestamp| type| source ---|---|--- 2026-07-08 14:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5dskju6a2g...

CVE-2026-58656

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

CVE-2026-58656 Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

EUVD-2026-42266

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: , allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token...

CVE-2026-56359

n8n prior to 2.8.0 contains a cross-site scripting vulnerability in the credential management flow. Authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields, enabling crafted credentials to cause the victim, who clicks the OAuth authorization button...

CVE-2026-56359

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth...

CVE-2026-15041

creationtimestamp| type| source ---|---|--- 2026-07-08 12:26:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq54jpsmpb27...

CVE-2026-57260

creationtimestamp| type| source ---|---|--- 2026-07-08 12:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq54c2bmsp26...

CVE-2026-57247

creationtimestamp| type| source ---|---|--- 2026-07-08 12:09:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq53l3gx5i2x...

CVE-2026-57254

creationtimestamp| type| source ---|---|--- 2026-07-08 12:07:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq53gm2i5k2g...

RLSA-2026:36317 Important: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: golang crypto/x509: Denial of...