PT-2026-47584

Summary An unauthenticated attacker Alice connects to FUXA's Socket.IO endpoint and emits a device-webapi-request event whose property.address field names an arbitrary URL. FUXA's DEVICE WEBAPI REQUEST handler at server/runtime/index.js:296 calls axios.getaddress server-side and broadcasts the fu...

CVE-2026-8833: Improper Neutralization of Input During Web Page Generation

Improper neutralization of HTML-encoded characters in the URL validation function in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows an authenticated user to bypass URL validation and inject malicious URLs such as javascript: URIs, resulting in cross-site scripting when another...

RHEL 10 : podman (RHSA-2026:24386)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:24386 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods...

python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens

A flaw was found in PyJWT. A remote attacker can exploit this by supplying an arbitrarily large Base64URL payload segment when verifying detached JSON Web Signature JWS tokens using the unencoded-payload option. This forces excessive CPU work and memory allocations, leading to a Denial of Service...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the /api/v1/sources/id/image-url endpoint, which fails to properly verify organizational ownership. An attacker can access and download OVA images containing sensitive data, such as...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the /api/v1/sources/id/image-url endpoint, which fails to properly verify organizational ownership. An attacker can access and download OVA images containing sensitive data, such as...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the /api/v1/sources/id/image-url endpoint, which fails to properly verify organizational ownership. An attacker can access and download OVA images containing sensitive data, such as...

CVE-2026-11436

creationtimestamp| type| source ---|---|--- 2026-06-06 16:45:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnn42sa3ui2b...

CVE-2026-11436

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mageai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirecturl results in cross site scripting. Remote...

CVE-2026-11436

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mageai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirecturl results in cross site scripting. Remote...

CVE-2026-11436 Mage AI Sign-in Flow index.tsx useMutation cross site scripting

A vulnerability was detected in Mage AI up to 0.9.79. This impacts the function useMutation of the file mageai/frontend/components/Sessions/SignForm/index.tsx of the component Sign-in Flow. Performing a manipulation of the argument query.redirecturl results in cross site scripting. Remote...

CVE-2026-11436

Mage AI up to version 0.9.79 is affected in the Sign-in Flow. The vulnerability is in the useMutation function within mage_ai/frontend/components/Sessions/SignForm/index.tsx, where manipulating the query.redirect_url argument triggers cross site scripting. Remote exploitation is possible, and the...

CVE-2026-11411

creationtimestamp| type| source ---|---|--- 2026-06-06 13:00:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmpi4r52i23...

CVE-2026-11412

creationtimestamp| type| source ---|---|--- 2026-06-06 12:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmow7vypb2d...

CVE-2026-6419

creationtimestamp| type| source ---|---|--- 2026-06-06 11:03:00+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mnmiwbavbk27...

CVE-2026-9016

creationtimestamp| type| source ---|---|--- 2026-06-06 08:49:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmbhfnw6f2n 2026-06-14 12:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3moaqqe3bb626 2026-09-29 12:47:19+00:00| seen|...

CVE-2026-7624

creationtimestamp| type| source ---|---|--- 2026-06-06 08:44:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnmb6h7h7r24...

CVE-2023-34282

creationtimestamp| type| source ---|---|--- 2026-06-06 05:01:16+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnlupg7x5h2r...

CVE-2026-9281

creationtimestamp| type| source ---|---|--- 2026-06-06 04:52:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlu7w5twa2d 2026-06-12 05:16:47+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mo2yeoi32w2w...

CVE-2026-8438

creationtimestamp| type| source ---|---|--- 2026-06-06 04:50:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnlu3eviqm2n 2026-06-07 00:01:08+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mnnufnkfqi2a...