requests-hardened is Vulnerable to Server-Side Request Forgery

The SSRF protection in requests-hardened prior to version 1.2.1 fails to block IP addresses within the RFC 6598 Shared Address Space 100.64.0.0/10. An attacker who can supply arbitrary URLs to requests-hardened could exploit this gap to access internal services hosted within 100.64.0.0/10. This i...

CVE-2026-44429

creationtimestamp| type| source ---|---|--- 2026-05-04 14:34:31+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4...

CVE-2026-7482

creationtimestamp| type| source ---|---|--- 2026-05-04 14:15:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzuc7suqr2k 2026-05-04 14:56:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkzwkpa3ak2k 2026-05-04 21:09:36+00:00| seen|...

CVE-2026-7736

A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this...

CVE-2026-7372

creationtimestamp| type| source ---|---|--- 2026-05-04 01:19:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkyiwbcqjd2w 2026-05-04 01:20:05+00:00| seen| https://bsky.app/profile/potato.software/post/3mkyixk7tez2l 2026-05-04 01:20:05+00:00| seen|...

RHCOS 4 : OpenShift Container Platform 4.18.6 (RHSA-2025:3068)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3068 advisory. - go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-27144 Note that Nessus has not tested for this issue but has instead...

RHCOS 4 : OpenShift Container Platform 4.11.17 (RHSA-2022:8626)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8626 advisory. - golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 - golang: net/http: handle server errors after...

MCP MetaTrader 4 Server 路径遍历漏洞

MCP MetaTrader 4 Server is a cross-platform trading integration tool developed by 8nite, a personal developer. Version 1.0.0 of MCP MetaTrader 4 Server contains a path traversal vulnerability. This vulnerability stems from the operation of the CallToolRequestSchema function in the src/index.ts...

PT-2026-39626

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15 Description An OS command injection issue exists in the Import/Export query export feature. Authenticated users can exploit this by providing unsanitized input that is interpolated directly into a psql copy...

CVE-2026-6530

DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service...

yggdrasil security update

0.4.8-4 - Bump release for rebuild...

CentOS 9 : sudo-1.9.17p2-4.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the sudo-1.9.17p2-4.el9 build changelog. - Privilege escalation due to failure in privilege drop calls CVE-2026-35535 Note that Nessus has not tested for this issue but has instead relied...

CVE-2025-62104 WordPress ACF Galerie 4 plugin <= 1.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Navneil Naicker ACF Galerie 4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Galerie 4: from n/a through 1.4.2...

WordPress ACF Galerie 4 plugin <= 1.4.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin ACF Galerie 4 versions = 1.4.2...

CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

PT-2026-39624

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15 Description A stored cross-site scripting XSS issue exists in the Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names, such as those for databases, schemas, tables, or columns,...

Photon OS 4.0: Openssl PHSA-2026-4.0-0993

An update of the openssl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0993. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-67030 affecting package plexus-utils for versions less than 3.3.0-4

CVE-2025-67030 affecting package plexus-utils for versions less than 3.3.0-4. A patched version of the package is available...

Important: Red Hat Security Advisory: HawtIO 4.3.1 for Red Hat build of Apache Camel 4 Release and security update.

HawtIO 4.3.1 for Red Hat build of Apache Camel 4 GA Release is now available. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product Security has rated this update ...

CVE-2019-25695

R 3.4.4 contains a local buffer overflow vulnerability that allows attackers to execute arbitrary code by injecting malicious input into the GUI Preferences language field. Attackers can craft a payload with a 292-byte offset and JMP ESP instruction to execute commands like calc.exe when the...