39918 matches found
CVE-2026-15668
creationtimestamp| type| source ---|---|--- 2026-07-14 05:37:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlihy3cf62k 2026-07-19 20:06:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzld5l5o42m 2026-07-19 20:06:17+00:00| seen|...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the handleNavigate function of the file pkg/browser/tool.go when manipulating the args.targetUrl argument. An attacker can access sensitive information by sending crafted requests remotely. Remediation There is n...
CVE-2026-15627
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The...
CVE-2026-15668
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...
Malicious code in fluterjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb8d561ceacd48c1883f6ec3151f5567240259b5ba54af3835fc0537f2f18933 The package's main and bin entry, server.js, starts an Express server bound to 0.0.0.0:10459 that exposes POST /ejecutar. The handler reads the JSON...
EUVD-2026-43616
A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This vulnerability affects the function handleNavigate of the file pkg/browser/tool.go. Such manipulation of the argument args.targetUrl leads to information disclosure. The attack may be performed from remote. The...
CVE-2026-53694
creationtimestamp| type| source ---|---|--- 2026-07-14 01:00:04+00:00| seen| https://t.me/bdufstecru/3284 2026-07-15 00:00:35+00:00| seen| https://t.me/bdufstecru/3284 2026-07-16 19:00:24+00:00| seen| Telegram/cWrr6fLMVkesc0a1CZjUiE2dAgXKJvGPc9k8JGOqheTq7M 2026-07-17 00:00:41+00:00| seen|...
EUVD-2026-43563
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...
EUVD-2026-43588
SAP HANA Database user self service tools allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts,...
ROS-20260714-73-0069
The vulnerability in Gitea relates to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...
PT-2026-57931
A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function web fetch of the file tools/tool web fetch.go of the component IPv4 Handler. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The...
PT-2026-57943
setThemeRoot failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored and used directly to construct a element, even when no tag was present in the document. The same bypass was reachable via the ?sap-themeRoot URL...
CVE-2026-56181: Origin Validation Error
Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...
CVE-2026-45067: Improper Neutralization of CRLF Sequences
Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...
PT-2026-58599
Name of the Vulnerable Software and Affected Versions Windows Network Address Translation NAT affected versions not specified Description An origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network, enabling th...
PT-2026-58898
Cilium is a networking, observability, and security solution. Prior to 1.17.16, from 1.18.2 to 1.18.9, and from 1.19.0 to 1.19.3, users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, enabling hijacking traffic to Services in any namespa...
PT-2026-60084
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate and Authorizer::supports paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as t...
CVE-2026-62192
creationtimestamp| type| source ---|---|--- 2026-07-13 22:42:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrbdxlxy2t...
CVE-2026-62184
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...
MAL-2026-10496 Malicious code in bubblestring (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d88c674968228c1d12eff609caca870ebe6d572631e15e2bdde0d0d4b7a320f9 package.json declares a postinstall hook that runs the package's only code file, index.js, on every npm install. index.js is heavily obfuscated...