124140 matches found
BIT-MARIADB-2026-44170 MariaDB: Argument injection in CONNECT REST Xcurl on Windows via unsanitized URL
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with installed CONNECT engine and enabled REST support interpolated table HTTP...
CVE-2026-8444
creationtimestamp| type| source ---|---|--- 2026-06-16 09:27:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofibk2zkh2g 2026-06-16 17:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mogbll4sir2c...
CVE-2026-6964
creationtimestamp| type| source ---|---|--- 2026-06-16 07:37:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mofc4ombc72m...
CVE-2026-53828
creationtimestamp| type| source ---|---|--- 2026-06-16 04:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moexzfti3f2v...
[SECURITY] Fedora 44 Update: perl-Mojo-JWT-1.02-1.fc44
JSON Web Token is described in https://tools.ietf.org/html/rfc7519. Mojo::JWT implements that standard with an API that should feel familiar to Mojolicious users though of course it is useful elsewhere. Indeed, JWT is much like Mojolicious::Sessions except that the result is a URL-safe text strin...
CVE-2026-48599
creationtimestamp| type| source ---|---|--- 2026-06-16 00:15:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moejf54fro22 2026-08-25 20:35:28+00:00| published-proof-of-concept| https://github.com/elixir-grpc/grpc/security/advisories/GHSA-mwr4-5g34-j5cq 2026-08-26 10:31:32+00:00|...
CVE-2026-12425: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting XSS. This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it...
RHEL 9 : podman (RHSA-2026:26445)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26445 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods...
PT-2026-53031
Summary The Docker API server let a request control where LLM calls were sent and which environment variable an LLM token resolved from. Both could be abused to exfiltrate server-held secrets. The Docker API is unauthenticated by default. Vector 1 - attacker base url /md, /llm, and /llm/job...
CVE-2026-47684: Server-Side Request Forgery (SSRF)
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses e.g. ::ffff:127.0.0.1, allowing SSRF protection to be bypassed ...
PT-2026-50182
Name of the Vulnerable Software and Affected Versions @mariozechner/pi-coding-agent versions 0.27.5 through 0.73.1 @earendil-works/pi-coding-agent versions 0.74.0 through 0.78.0 Description Pi HTML exports render session Markdown into a static HTML file but fail to consistently reject unsafe...
CVE-2026-52702
creationtimestamp| type| source ---|---|--- 2026-06-15 23:53:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moei6c4drq2j...
CVE-2026-52692
creationtimestamp| type| source ---|---|--- 2026-06-15 23:01:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moefbee6n22n...
CVE-2026-11832
creationtimestamp| type| source ---|---|--- 2026-06-15 22:14:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3moecmi2a4n2q 2026-06-15 23:57:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moeiet2rl42p 2026-06-17 07:00:40+00:00| seen|...
GHSA-P85R-X2WJ-MXQJ shlink has a Server-Side Request Forgery issue
A Server-Side Request Forgery SSRF in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl...
EUVD-2026-36786
An authenticated Server-Side Request Forgery SSRF in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL...
GHSA-JP82-JPQV-5VV3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Summary In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example @google.com moves the authority boundary...
Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname
Summary In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example @google.com moves the authority boundary...