CVE-2026-6716

creationtimestamp| type| source ---|---|--- 2026-06-19 01:44:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mom7qsxmdr2m...

GHSA-6VVH-PXR4-25R7

creationtimestamp| type| source ---|---|--- 2026-06-19 01:41:43+00:00| seen| https://gist.github.com/alon710/f3e92e03dae92147bc7c79e5359c6c2b 2026-06-19 01:51:20+00:00| seen| https://gist.github.com/alon710/b1b22df575bfbbf1e201aedc3467bcba...

CVE-2026-56076

creationtimestamp| type| source ---|---|--- 2026-06-19 01:35:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mom7at33nr2r...

CVE-2026-47262

creationtimestamp| type| source ---|---|--- 2026-06-19 01:31:49+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mom72udh7u25 2026-07-01 19:59:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmckxbuhm2m 2026-07-02 10:29:25+00:00| seen|...

CVE-2026-50195

creationtimestamp| type| source ---|---|--- 2026-06-19 01:31:49+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mom72udh7u25 2026-06-19 09:11:46+00:00| seen| https://bsky.app/profile/canartuc.com/post/3momyrcpuo42y 2026-06-19 10:03:46+00:00| seen|...

CVE-2026-8100

creationtimestamp| type| source ---|---|--- 2026-06-19 01:14:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mom636yl5f2e 2026-09-29 12:47:17+00:00| seen| https://infosec.exchange/users/cR0w/statuses/117354399908091855...

PT-2026-50946

Name of the Vulnerable Software and Affected Versions GridTime 3000 versions 1.0r0.03 through 1.1r0.0 Description The GridTime 3000 GNSS Time Server leaks the access token within the URL parameters of certain endpoints. Recommendations Update GridTime 3000 versions 1.0r0.03 through 1.1r0.0 to a...

PT-2026-51002

Name of the Vulnerable Software and Affected Versions PhpWeasyPrint versions prior to 2.6.0 Description PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The library fetches content of option values server-side using the file get contents function when a value is...

PT-2026-50971

Summary In affected versions, Request::buildRequestUrl inserts path variables into the request URL without URL encoding implode'/', $pathVariables. All request classes implementing getPathVariables are affected, e.g. GetContentDetailsRequest scheme, contentId. If a consuming application passes...

PT-2026-51010

Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description A flaw exists in the GitHub webhook integration where the controller stores the pull request.statuses url value from a pull request webhook payload without validating if it points to a trusted...

PT-2026-51107

Summary With $wgEmbedVideoRequireConsent enabled the default, the urls for videos are stored in a json-ified data attributedata-mw-iframeconfig. When given a malformed url or id, the data-mw-iframeconfig attribute can be escaped via single quotes, allowing for html/javascript injection. Details T...

PT-2026-51122

Name of the Vulnerable Software and Affected Versions Symfony UX Icons affected versions not specified Description The ux icon Twig function is marked as safe for HTML, which prevents Twig from escaping its output. The Icon::toHtml function inlines SVG source code directly into the page. Because...

PT-2026-53803

Unbounded Response Body Read Bypasses URL Size Limit in web url read Summary The web url read MCP tool in mcp-searxng enforces its 5 MiB response-size limit exclusively by inspecting the Content-Length header of a preliminary HEAD request. When a server omits Content-Length — a standard HTTP...

PT-2026-53783

SurrealDB fetches the JWKS document for a JWT or record access method using a bare reqwest client that follows HTTP redirects by default. The network capability check in core/src/iam/jwks.rs check capabilities url is applied only to the originally configured URL; redirect targets are not...

PT-2026-53791

DNS-resolved Private Hostname SSRF in web url read Summary The web url read MCP tool in mcp-searxng is vulnerable to Server-Side Request Forgery SSRF via DNS rebinding bypass. The assertUrlAllowed function at src/url-reader.ts:85-93 validates only the syntactic hostname string against a private...

CVE-2026-47645: URL Redirection to Untrusted Site

Url redirection to untrusted site 'open redirect' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network...

CVE-2017-20269: Improper Neutralization of Special Elements used in an SQL Command

Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component URL path. Attackers can supply malicious SQL code in the kissgallery endpoint to execute arbitrary database queries and extract sensitive...

CVE-2026-12622: URL Redirection to Untrusted Site

The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0...

CVE-2026-12620: Exposure of Sensitive Information to an Unauthorized Actor

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0...

CVE-2026-44915: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache APISIX. The default configuration of cas-auth in Apache APISIX is vulnerable to phishing and credential theft. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0,...