CVE-2026-33440 Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWEDASSETDOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17...

What Is a Risk-Based Vulnerability Management Platform?

A vulnerability scanner tells you where the cracks are in your defenses, but it doesn't tell you which ones an attacker will actually use. To truly understand your exposure, you need to see your network from their perspective. How can a low-severity flaw on one server be combined with a...

Weblate 安全漏洞

Weblate is an open-source, copyleft, web-based free software system for continuous localization. Versions of Weblate prior to 5.17 contained a security vulnerability. This vulnerability stemmed from the ALLOWEDASSETDOMAINS setting, which applied only to initial requests and did not restrict...

PT-2026-33117

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED ASSET DOMAINS setting applied only to the first issued requests and didn't restrict possible redirects. This issue has been fixed in version 5.17...

PT-2026-33231

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.22.0 Description The Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity XXE processing,...

Server-side Request Forgery (SSRF)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the asset upload mutations process. An attacker can interact with internal services by supplying specially crafted URLs using unsupported schemes, such as...

Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

Required Permissions The exploitation requires a few permissions to be enabled in the used GraphQL schema: "Edit assets in the volume" "Create assets in the volume" Details The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no...

GHSA-3M9M-24VH-39WX Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations

Required Permissions The exploitation requires a few permissions to be enabled in the used GraphQL schema: "Edit assets in the volume" "Create assets in the volume" Details The implementation fails to restrict the URL Scheme. While the application is intended to "upload assets", there is no...

WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

Summary Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently: 1. Cast/flip the...

GHSA-X2PW-9C38-CP2J WWBN AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Creation, Vote Manipulation, and Category Asset Deletion

Summary Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $REQUEST/$GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently: 1. Cast/flip the...

Threat Intelligence for Exposure Management: How TI Powers Smarter CTEM Programs

Your security team has access to more vulnerability data than ever before. Scanners produce thousands of findings each week. Threat feeds deliver a steady stream of indicators. Yet most organizations still struggle with the same fundamental problem: deciding what to fix first. The disconnect...

PT-2026-35128

Summary Multiple AVideo JSON endpoints under objects/ accept state-changing requests via $ REQUEST/$ GET and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently: 1. Cast/flip th...

Note Mark has Broken Access Control on Asset Download

Summary A broken access control vulnerability allows unauthenticated users to retrieve note assets directly from the asset download endpoint when they know both the note UUID and asset UUID. This exposes the full contents of private note assets without authentication, even when the associated boo...

Note Mark has Stored XSS via Unrestricted Asset Upload

Summary A stored same-origin XSS vulnerability allows any authenticated user to upload an HTML, SVG, or XHTML file as a note asset and have it executed in a victim’s browser under the application’s origin. Because the application serves these files inline without a safe content type and without...

GHSA-9PR4-RF97-79QH Note Mark has Stored XSS via Unrestricted Asset Upload

Summary A stored same-origin XSS vulnerability allows any authenticated user to upload an HTML, SVG, or XHTML file as a note asset and have it executed in a victim’s browser under the application’s origin. Because the application serves these files inline without a safe content type and without...

What Is CAASM? Cyber Asset Attack Surface Management Explained

Your security team runs scans from five different tools. Each one gives you a different number of assets, a different count of vulnerabilities, and a different view of your risk. Meanwhile, your CMDB is outdated, shadow IT keeps expanding, and nobody can confidently answer a basic question: "What...

Vulnerability Assessment vs Penetration Testing: What Security Leaders Need to Know

Your organization runs quarterly vulnerability scans. You get a report with hundreds, sometimes thousands, of findings. Your team patches what they can and moves on. Six months later, you bring in a penetration testing firm, and they walk right through your defenses using a chain of...

CVEs

CVE-2025-63743: Authe...

EUVD-2026-21647

The GreenShift - Animation and Page Builder Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 12.8.9 This is due to insufficient input sanitization and output escaping in the gspbgreenShiftblockscriptassets function. The function uses...

PT-2026-32118

Name of the Vulnerable Software and Affected Versions Note Mark versions prior to 0.19.2 Description A stored same-origin cross-site scripting XSS issue exists where the asset delivery handler serves uploaded files inline and relies on magic-byte detection for content type. This method fails to...