PT-2026-50182

Name of the Vulnerable Software and Affected Versions @mariozechner/pi-coding-agent versions 0.27.5 through 0.73.1 @earendil-works/pi-coding-agent versions 0.74.0 through 0.78.0 Description Pi HTML exports render session Markdown into a static HTML file but fail to consistently reject unsafe...

CVE-2026-52702

creationtimestamp| type| source ---|---|--- 2026-06-15 23:53:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moei6c4drq2j...

CVE-2026-52692

creationtimestamp| type| source ---|---|--- 2026-06-15 23:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moefbee6n22n...

CVE-2026-11832

creationtimestamp| type| source ---|---|--- 2026-06-15 22:14:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3moecmi2a4n2q 2026-06-15 23:57:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moeiet2rl42p 2026-06-17 07:00:40+00:00| seen|...

GHSA-P85R-X2WJ-MXQJ shlink has a Server-Side Request Forgery issue

A Server-Side Request Forgery SSRF in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl...

EUVD-2026-36786

An authenticated Server-Side Request Forgery SSRF in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL...

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

Summary In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example @google.com moves the authority boundary...

GHSA-JP82-JPQV-5VV3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

Summary In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example @google.com moves the authority boundary...

CVE-2026-11931

creationtimestamp| type| source ---|---|--- 2026-06-15 20:29:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe4s2nu5y2x...

CVE-2026-53705

creationtimestamp| type| source ---|---|--- 2026-06-15 20:23:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe4gpjlgt2w...

CVE-2026-50888

An authenticated Server-Side Request Forgery SSRF in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL...

CVE-2026-50887

A Server-Side Request Forgery SSRF in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl...

CVE-2026-52720

creationtimestamp| type| source ---|---|--- 2026-06-15 20:11:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe3rrgugs2w 2026-07-09 22:34:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqaoxyycp52y 2026-07-09 22:35:04+00:00| seen|...

CVE-2026-9258

creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 04:03:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moew5wcalk2n 2026-06-16 04:31:16+00:00| seen|...

CVE-2026-9259

creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 03:57:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moevt6c3uo2i 2026-06-16 04:31:16+00:00| seen|...

NPM: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

NPM: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization vulnerability discovered by ? in WordPress Npm nodemailer versions = 8.0.8...

GHSA-WQVQ-JVPQ-H66F Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization

Summary Nodemailer's disableFileAccess and disableUrlAccess options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in MimeNode.getStream. However, jsonTransport serializes messages by calling...

GHSA-H5X3-XFC9-M39H Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Description Symfony\Component\Routing\Generator\UrlGenerator::doGenerate percent-encodes . and .. path segments so that the generated URL still resolves to the originating route after RFC 3986 §5.2.4 dot-segment removal which strict RFC-3986 consumers — routers, reverse proxies, HTTP clients —...

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Description Symfony\Component\Routing\Generator\UrlGenerator::doGenerate percent-encodes . and .. path segments so that the generated URL still resolves to the originating route after RFC 3986 §5.2.4 dot-segment removal which strict RFC-3986 consumers — routers, reverse proxies, HTTP clients —...

@babel/core: Arbitrary File Read via sourceMappingURL Comment

Impact Using @babel/core to compile maliciously crafted code can allow ab attacker to read any source map from the system that is running Babel, if these conditions are all true: - the attacker controls the input source code - the attacker can read the output source code - the attacker knows the...