13415 matches found
CVE-2026-58468 NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin...
GO-2026-5853 Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio
Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OIDC discovery process. An attacker can cause the service to follow malicious redirects, leading to server-side request forgery and potential exposure of Kubernetes service-account tokens by...
MAL-2026-9005 Malicious code in trya3zz (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
PYSEC-2026-1311 Docassemble HTML and javascript injection
Impact A user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain tags allowing JavaScript to execute on the page. Patches The vulnerability has been patched in version 1.4.97 of the master...
Cisco IOS XE Software Wireless Controller Discovery Protocol DoS (cisco-sa-ewlc-cdp-dos-fpeks9K)
According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is du...
PT-2026-56298
Name of the Vulnerable Software and Affected Versions @better-auth/sso versions 0.1.0 through 1.6.10 @better-auth/sso versions 1.7.0-beta.x Description An SSRF flaw exists in the provider registration flow where OpenID Connect OIDC endpoint URLs are accepted without proper validation. When...
WordPress ChatBot plugin <= 8.3.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin ChatBot versions = 8.3.7...
WordPress tagDiv Composer plugin <= 5.4.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin tagDiv Composer versions = 5.4.5...
WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by VanTastic in WordPress Plugin Kirki versions = 6.0.11...
SUSE-SU-2026:22522-1 Security update for the Linux Kernel
The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-40341: futex: Don't leak robustlist pointer on exec race bsc1255029. - CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs...
WordPress AR for WooCommerce plugin <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read vulnerability
Unauthenticated Path Traversal to Arbitrary File Read vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin AR For Woocommerce versions = 8.40...
PYSEC-2026-852 OpenStack Neutron Intended MAC-spoofing protection mechanism bypass
The IPTables firewall in OpenStack Neutron up to 7.0.4 and 8.x before 8.1.0 allows remote attackers to bypass an intended MAC-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via 1 a crafted DHCP discovery message or 2 crafted non-IP traffic...
PYSEC-2026-854 OpenStack Neutron allows remote attackers to bypass an intended DHCP-spoofing protection mechanism
The IPTables firewall in OpenStack Neutron before 7.0.4 and 8.0.0 through 8.1.0 allows remote attackers to bypass an intended DHCP-spoofing protection mechanism and consequently cause a denial of service or intercept network traffic via a crafted DHCP discovery message...
Malicious code in @logdna-web/styles (npm)
The @logdna-web/styles package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the @logdna-w...
MAL-2026-10229 Malicious code in enbd-react-error-boundry (npm)
The enbd-react-error-boundry package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization an 'enb...
CVE-2026-48206
creationtimestamp| type| source ---|---|--- 2026-07-05 20:24:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpwftcmt4q2i 2026-07-22 17:00:06+00:00| seen| Telegram/BYZ8BSkX5tqDJQpjrZq--1jgIV2vuNjSoj1tdR21kZx6jI 2026-07-23 00:00:07+00:00| published-proof-of-concept|...
VDT
Vulnerability Discovery Training VDT Training data for adva...
CVE-2026-12740
creationtimestamp| type| source ---|---|--- 2026-07-04 18:32:26+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mptp3oty7u2x 2026-07-04 23:52:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpuaxihqki2a 2026-07-05 06:49:35+00:00| seen|...