CVE-2026-41516

creationtimestamp| type| source ---|---|--- 2026-07-06 20:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyvmfdnjw26...

CVE-2026-57573

CVE-2026-57573 affects Crawl4AI: unauthenticated SSRF via the Docker stream endpoint. Before 0.9.0, SSRF checks were only on the non‑streaming /crawl path; handle_stream_crawl_request forwarded seed URLs with no destination validation. This allowed a remote, unauthenticated client to POST to /cra...

CVE-2026-42546

creationtimestamp| type| source ---|---|--- 2026-07-06 20:02:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyv2zsuzr2w...

CVE-2026-55646

creationtimestamp| type| source ---|---|--- 2026-07-06 19:57:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyuqutnll24 2026-07-09 15:03:14+00:00| seen| https://gist.github.com/Correctover/dcf89533dd8acf055791178f2130e704 2026-07-09 15:09:36+00:00| seen|...

CVE-2026-50133

creationtimestamp| type| source ---|---|--- 2026-07-06 19:55:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyunv5kaz2v...

CVE-2026-41515

creationtimestamp| type| source ---|---|--- 2026-07-06 19:53:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyul2ihh72b...

CVE-2026-50134 Hugo: security.http.urls allow-list bypass via HTTP redirects

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...

CVE-2026-35339

creationtimestamp| type| source ---|---|--- 2026-07-06 19:41:46+00:00| seen| https://gist.github.com/alon710/194b323308c6542ff0a22bb475e2c02f...

EUVD-2026-41915

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image U...

CVE-2026-14898

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image U...

CVE-2026-24012

creationtimestamp| type| source ---|---|--- 2026-07-06 19:14:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyseyhbm32c...

CVE-2026-40140

creationtimestamp| type| source ---|---|--- 2026-07-06 17:22:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpym3v2pgs22 2026-07-06 17:48:42+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpynkx35vt2f 2026-07-07 12:25:11+00:00| seen|...

CVE-2026-57640

creationtimestamp| type| source ---|---|--- 2026-07-06 17:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpylpcbfij2n...

CVE-2025-15668

creationtimestamp| type| source ---|---|--- 2026-07-06 16:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpykcrz2ok2z...

CVE-2026-59152

creationtimestamp| type| source ---|---|--- 2026-07-06 16:30:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyj6ybouc2b...

CVE-2025-53827

creationtimestamp| type| source ---|---|--- 2026-07-06 16:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhmrqo542c 2026-07-06 17:24:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpym7ct5ri23...

CVE-2026-5268

creationtimestamp| type| source ---|---|--- 2026-07-06 15:57:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhdrykfp22 2026-07-06 19:26:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpyszhqb762x...

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

CVE-2026-54893

Swoosh.Adapters.MsGraph is vulnerable to URL path injection via the from-address interpolation into /users/{from}/sendMail without percent-encoding or validation. If from derives from untrusted input, an attacker can inject URL-special characters (/, ?, #) to escape the intended path and rewrite ...