GHSA-8GRP-WCQ9-925Q

creationtimestamp| type| source ---|---|--- 2026-06-17 00:41:42+00:00| seen| https://gist.github.com/alon710/244419ca59c137ef079d33a9b117602b...

CVE-2026-11410

creationtimestamp| type| source ---|---|--- 2026-06-17 00:40:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh3bjgwv222...

CVE-2026-49057

creationtimestamp| type| source ---|---|--- 2026-06-17 00:28:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh2k5rnnn2g 2026-06-22 21:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3movsnd7qvk2k...

CVE-2026-48783

creationtimestamp| type| source ---|---|--- 2026-06-17 00:11:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogznfyenc2x...

CVE-2026-8317

creationtimestamp| type| source ---|---|--- 2026-06-17 00:09:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogzjt5rpz2x...

CVE-2026-47277

creationtimestamp| type| source ---|---|--- 2026-06-17 00:07:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogzghhrvn2v...

CVE-2026-48781

creationtimestamp| type| source ---|---|--- 2026-06-17 00:03:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogz6imvsz26...

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

org.hl7.fhir.utilities.XsltUtilities exposes two parallel families of XSLT transform helpers. The transform... overloads obtain their TransformerFactory from the project's hardened helper XMLUtil.newXXEProtectedTransformerFactory which sets ACCESSEXTERNALDTD="" and ACCESSEXTERNALSTYLESHEET="". Th...

PT-2026-50481

Name of the Vulnerable Software and Affected Versions Open-webui affected versions not specified Description An authenticated user can access files belonging to other users by exploiting a lack of ownership verification in the image processing path. When the POST endpoint "/api/chat/completions"...

PT-2026-50500

Name of the Vulnerable Software and Affected Versions Cisco Webex App affected versions not specified Description An issue in the browser-based version of the application allows an unauthenticated remote attacker to redirect users to a malicious webpage. This occurs due to improper input validati...

PT-2026-50592

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied url idx path parameter and uses it as a raw index in...

PT-2026-50609

Name of the Vulnerable Software and Affected Versions Drupal core affected versions not specified Description The Media module supports oEmbed, which utilizes two discovery mechanisms: providers.json and URL discovery. The URL discovery code can be exploited to trick the system into making...

PT-2026-50590

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The SafePlaywrightURLLoader uses a validate url function to prevent Server-Side Request Forgery SSRF by checking the IP address of a user-provided URL. However, this validation only occurs for the...

CVE-2026-20178: URL Redirection to Untrusted Site

A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to a malicious webpage. Cisco has addressed this vulnerability in the Cisco Webex App, and no customer action is needed. This vulnerability existed due to...

CVE-2025-32748: URL Redirection to Untrusted Site

Dell PowerFlex Manager, versions prior to 5.1.0.1, contains a Host Header Injection vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability to trigger redirections...

CVE-2026-9570: Undefined Security Weakness

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user...

CVE-2026-10839: URL Redirection to Untrusted Site

Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs generated by the application. A successful exploit could redirect authenticated users to malicious sites following login procedures or...

CVE-2026-48294: Improper Neutralization of Input During Web Page Generation

Adobe Acrobat PDF Extension Chrome versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in tha...

Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery. The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL...

Bosch Security Systems IP Cameras Uncontrolled Resource Consumption (CVE-2021-23852)

An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service DoS. This plugin only works with Tenable.ot. Please visit...