Mautic Focus component Vulnerable to SSRF

Summary A Server-Side Request Forgery SSRF vulnerability exists in the Mautic Focus component MauticFocusBundle. Under certain conditions, insufficiency in validating user-supplied URLs allows authenticated users to trigger outbound HTTP requests from the hosting server. Impact An authenticated...

EUVD-2026-41426

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...

CVE-2026-59095 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...

CVE-2026-59095 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...

CVE-2026-59095

CVE-2026-59095 affects LobeChat prior to 2.2.10-canary.18. It is a server-side request forgery (SSRF) vulnerability where authenticated attackers can supply input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints that use the global fetch without the...

CVE-2026-59095

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...

CVE-2026-58578

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

Security Bulletin: SSRF Protection Configuration Vulnerability

Summary A configuration vulnerability was identified where SSRF Server-Side Request Forgery protection could be disabled through default settings, potentially allowing authenticated users to make the server fetch arbitrary URLs including cloud metadata endpoints 169.254.169.254, internal services...

GHSA-8882-FRVV-92W4 @asymmetric-effort/specifyjs: URL parse failure silently allows request

Finding Location: core/src/shared/secure-fetch.ts:42-45 When new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Status Fixed in v0.2.136 — The catch block now throws an error instead of silently...

CVE-2026-55110

creationtimestamp| type| source ---|---|--- 2026-07-02 18:51:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpop7glvx22w 2026-07-03 07:07:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppydky5l42i 2026-07-08 11:01:21+00:00| seen|...

CVE-2026-50746

creationtimestamp| type| source ---|---|--- 2026-07-02 18:21:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mponk2wkp327 2026-07-03 21:35:47+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpriumewrl2b 2026-07-07 13:30:26+00:00| seen|...

CVE-2025-58902

creationtimestamp| type| source ---|---|--- 2026-07-02 17:05:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpojbp3e6w2v 2026-07-03 03:26:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpplzmqmgt2k 2026-07-03 11:39:39+00:00| seen|...

NPM: OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs

NPM: OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.4.29...

CVE-2026-57760

creationtimestamp| type| source ---|---|--- 2026-07-02 16:04:20+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpofuyuxxe24 2026-07-03 00:46:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppd2oktjy2i 2026-07-03 03:53:14+00:00| seen|...

CVE-2026-8079

creationtimestamp| type| source ---|---|--- 2026-07-02 15:21:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpodiemxpv26 2026-07-03 07:25:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppzdjgcdz26 2026-07-03 09:37:20+00:00| seen|...

CVE-2026-36909

creationtimestamp| type| source ---|---|--- 2026-07-02 14:30:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoanicpv22q 2026-07-03 09:21:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq7tp5mhs2y...

CVE-2026-55793

creationtimestamp| type| source ---|---|--- 2026-07-02 14:29:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaley52l2b 2026-07-06 22:35:07+00:00| published-proof-of-concept| https://github.com/craftcms/cms/security/advisories/GHSA-xrqc-p465-2xvg 2026-07-07 01:42:10+00:00|...

CVE-2026-54262

creationtimestamp| type| source ---|---|--- 2026-07-02 14:28:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaj35qfl27 2026-07-03 13:26:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnk6jp5n2c...

CVE-2026-54260

creationtimestamp| type| source ---|---|--- 2026-07-02 14:26:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoafqta2k2q 2026-07-03 13:26:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnj7hxnt2y...

CVE-2026-36911

creationtimestamp| type| source ---|---|--- 2026-07-02 14:23:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaauvk6h2r 2026-07-03 09:22:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq7vrw7en2m...