123358 matches found
CVE-2026-9099
creationtimestamp| type| source ---|---|--- 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:39+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0815 2026-07-02 05:18:11+00:00| seen|...
CVE-2026-6638
creationtimestamp| type| source ---|---|--- 2026-06-29 13:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkznxcc72u 2026-07-01 02:45:31+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0816 2026-08-05 08:45:03+00:00| seen|...
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...
CVE-2026-13560
A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...
CVE-2026-13554
creationtimestamp| type| source ---|---|--- 2026-06-29 12:06:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgh6k26bc25...
CVE-2026-13552
creationtimestamp| type| source ---|---|--- 2026-06-29 12:05:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgh5oi7yr2n...
PYSEC-2026-339 FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...
PYSEC-2026-495 pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
Summary The fix for CVE-2026-33992 GHSA-m74m-f7cr-432x added IP validation to BaseDownloader.download that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are...
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Technical DescriptionThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service.A critical vulnerability exists in the buildurl method. When an OpenAPI...
PYSEC-2026-338 FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Technical Description The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A critical vulnerability exists in the buildurl method. When an OpenAPI...
PYSEC-2026-497 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...
CVE-2026-13560 Edimax EW-7478APC POST Request formAccept os command injection
A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...
CVE-2026-13560
Summary : CVE-2026-13560 affects Edimax EW-7478APC (firmware 1.04). The vulnerable component is the POST Request Handler’s /goform/formAccept function, where manipulating the argument submit-url enables an OS command injection . The attack is remote and the exploit has been disclosed publicly. Th...
CVE-2026-13560 Edimax EW-7478APC POST Request formAccept os command injection
A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...
MAL-2026-6592 Malicious code in maplibre-gl-vue3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815 The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects...
CVE-2026-13537
creationtimestamp| type| source ---|---|--- 2026-06-29 08:09:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfzx2zswj2a 2026-06-29 10:48:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgctwjk7522 2026-06-29 13:09:08+00:00| seen|...
CVE-2019-0001
creationtimestamp| type| source ---|---|--- 2026-06-29 07:54:37+00:00| seen| https://gist.github.com/tu-trinh-scale/cb28617ddc3f6adf2b7f5da89706e0f7...
CVE-2017-0003
creationtimestamp| type| source ---|---|--- 2026-06-29 07:54:37+00:00| seen| https://gist.github.com/tu-trinh-scale/cb28617ddc3f6adf2b7f5da89706e0f7 2026-07-26 07:02:13+00:00| seen| https://t.me/KaitNews/2468 2026-07-27 00:01:51+00:00| seen| https://t.me/KaitNews/2468 2026-08-05 20:00:04+00:00|...
CVE-2026-54815
creationtimestamp| type| source ---|---|--- 2026-06-29 07:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpfwxrmzjl2i...
CVE-2026-13543
A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Login. The manipulation results in improper authentication. It is possible to...