nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

CVE-2026-54893

Swoosh.Adapters.MsGraph is vulnerable to URL path injection via the from-address interpolation into /users/{from}/sendMail without percent-encoding or validation. If from derives from untrusted input, an attacker can inject URL-special characters (/, ?, #) to escape the intended path and rewrite ...

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

CVE-2026-54291

creationtimestamp| type| source ---|---|--- 2026-07-06 13:50:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpyaapk5fs2o 2026-07-06 20:36:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpywxzrvi324 2026-07-19 22:07:08+00:00| seen|...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-4249

creationtimestamp| type| source ---|---|--- 2026-07-06 12:22:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy3dicdxy2n 2026-07-13 00:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqifjigmk42f...

CVE-2026-14743

creationtimestamp| type| source ---|---|--- 2026-07-06 11:39:45+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mpxyxlv7ix2z...

CVE-2026-36174

creationtimestamp| type| source ---|---|--- 2026-07-06 11:37:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxyu37pek2f...

CVE-2025-8591

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can...

CVE-2026-36175

creationtimestamp| type| source ---|---|--- 2026-07-06 11:15:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxxmgdpla2n...

CVE-2026-57650

creationtimestamp| type| source ---|---|--- 2026-07-06 11:15:21+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpxxlwrxud2m...

CVE-2026-30352

creationtimestamp| type| source ---|---|--- 2026-07-06 11:14:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxxjxrgvz2j...

CVE-2025-65783

creationtimestamp| type| source ---|---|--- 2026-07-06 11:12:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxxhnrhgp2j...

OESA-2026-2825 NetworkManager security update

NetworkManager attempts to keep an active network connection available at all times. The point of NetworkManager is to make networking configuration and setup as painless and automatic as possible. If using DHCP, NetworkManager is intended to replace default routes, obtain IP addresses from a DHC...

CVE-2025-29329

creationtimestamp| type| source ---|---|--- 2026-07-06 11:07:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxx55vsds2i...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the default ObjectInputFilter. An attacker can trigger DNS-based information disclosure by sending a Java-serialized payload that deserializes into a collection such as HashMap containing...

CVE-2026-58467

A flaw was found in Cockpit CMS. This vulnerability, a path traversal and local file inclusion, allows an unauthenticated attacker to read arbitrary files or execute PHP files. By manipulating the URL, an attacker can bypass security checks and access restricted directories. This could lead to...