124171 matches found
CVE-2026-21037: Undefined Security Weakness
Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity with Samsung Members privilege...
PT-2026-47032
Name of the Vulnerable Software and Affected Versions WP Captcha PRO versions prior to 5.39 Description The plugin is susceptible to arbitrary file upload, which can lead to remote code execution. The issue stems from a flawed capability check in the save ajax function within the licensing module...
CVE-2026-21826: URL Redirection to Untrusted Site
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways...
RockyLinux 10 : git-lfs (RLSA-2026:19133)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19133 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the roo...
RockyLinux 10 : osbuild-composer (RLSA-2026:22450)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22450 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...
CVE-2026-42547
creationtimestamp| type| source ---|---|--- 2026-06-04 23:16:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mniqyn4crz2g...
CVE-2026-42329
creationtimestamp| type| source ---|---|--- 2026-06-04 22:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnipvx2imz2h...
CVE-2026-5066
creationtimestamp| type| source ---|---|--- 2026-06-04 22:42:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnip2hi5672f...
CVE-2026-48522
A flaw was found in PyJWT, a JSON Web Token implementation in Python. The PyJWKClient component, prior to version 2.13.0, directly passes its Uniform Resource Identifier URI argument to urllib.request.urlopen. This allows a remote attacker, by influencing the application's jku URL ingestion path,...
GHSA-GQ96-5PFX-F4VC Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Summary The /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against private/reserved ranges via FileUrlValidator, the linkURL flow only...
CVE-2026-48040
creationtimestamp| type| source ---|---|--- 2026-06-04 19:29:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mniecjvsyh2f...
CVE-2026-50292
creationtimestamp| type| source ---|---|--- 2026-06-04 19:14:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnidhojmn72x 2026-06-11 12:18:10+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mnz7hachms2l 2026-06-11 12:18:11+00:00| seen|...
CVE-2026-7774
creationtimestamp| type| source ---|---|--- 2026-06-04 16:25:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnhzymng362i 2026-06-05 13:35:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnkaxtlnnt2f 2026-10-22 21:10:10+00:00| seen|...
Exploit for CVE-2026-8732
CVE-2026-8732 – WordPress WP Maps Pro Exploit Unauthenticat...
CVE-2026-43986
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public /image/ route that resolves attacker-controlled entries from imagehashlookup and replays them through the same server-side image fetch logic used by authenticated image proxying...
PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation
A flaw was found in PHP, specifically within the PHP-FPM status page. Due to improper sanitation of user data, a remote attacker can craft a malicious URL. When a user views the PHP-FPM status page with this crafted URL, it can lead to the execution of arbitrary JavaScript code Cross-Site Scripti...
CVE-2026-10809
creationtimestamp| type| source ---|---|--- 2026-06-04 15:34:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnhx5xhi3a2g...
PYSEC-2026-2282
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...
CVE-2026-45739
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...