React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

This is a follow up to CVE-2025-68470. React Router was alerted to certain scenarios in which the fix there was incomplete so there still existed some scenarios where attacker supplied paths passed to navigation mechanisms could result in unexpected external navigations...

CVE-2026-48013

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-48013

CVE-2026-48013 (Shopware) is an SSRF in the media external-link flow. Authenticated admins can cause server-side HEAD requests from the endpoint /api/_action/media/external-link to arbitrary internal IPs, bypassing the existing depth of IP checks used by the parallel uploadFromURL flow. The vulne...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-62548

creationtimestamp| type| source ---|---|--- 2026-07-23 18:20:56+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61122

creationtimestamp| type| source ---|---|--- 2026-07-23 18:15:05+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-27 15:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrn7zczya523...

CVE-2026-44909

creationtimestamp| type| source ---|---|--- 2026-07-23 18:10:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdgqdqney2c 2026-07-23 19:42:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdluqw6m72f...

CVE-2026-61090

creationtimestamp| type| source ---|---|--- 2026-07-23 17:52:13+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61053

creationtimestamp| type| source ---|---|--- 2026-07-23 17:51:25+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60828

creationtimestamp| type| source ---|---|--- 2026-07-23 17:47:42+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60446

creationtimestamp| type| source ---|---|--- 2026-07-23 17:16:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 17:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrftpac2nn2y 2026-07-25 12:07:06+00:00| seen|...

CVE-2026-60436

creationtimestamp| type| source ---|---|--- 2026-07-23 17:16:32+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-60384

creationtimestamp| type| source ---|---|--- 2026-07-23 17:15:27+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 18:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrfxpybzca2r 2026-07-29 11:37:07+00:00| seen|...

CVE-2026-14257

creationtimestamp| type| source ---|---|--- 2026-07-23 17:02:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvmlwzj22 2026-07-24 22:35:03+00:00| published-proof-of-concept| https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg...

CVE-2026-61178

creationtimestamp| type| source ---|---|--- 2026-07-23 16:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdchceyni2y 2026-07-23 18:16:57+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61175

creationtimestamp| type| source ---|---|--- 2026-07-23 16:52:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcdqyu3n2v 2026-07-23 18:16:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61174

creationtimestamp| type| source ---|---|--- 2026-07-23 16:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcdps45p24 2026-07-23 18:16:52+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...