CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...

EUVD-2026-41608

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write...

CVE-2026-46556

The CVE describes a Server-Side Request Forgery (SSRF) in FlaskBB prior to 2.2.1, where get_image_info(url) passes the supplied URL directly to requests.get without validating scheme/host/IP. This allows any authenticated user to cause the server to access internal endpoints and cloud metadata se...

Gitea: draft release attachment disclosure via missing web authorization

Summary Gitea's draft-release access control is enforced only on the API release endpoints /api/v1/repos/owner/repo/releases/id and its /assets/... sub-routes but not on the web-level UUID-based attachment endpoints /attachments/uuid, /owner/repo/attachments/uuid,...

CVE-2026-59146

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sphwalkcell and sphallocslot. The attach-time validator sphvalidateheader checks the header scalars and region layout against the file size, but does...

CVE-2026-64615 Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-16451

creationtimestamp| type| source ---|---|--- 2026-07-21 18:36:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6ha4qrux24...

CVE-2026-24232

creationtimestamp| type| source ---|---|--- 2026-07-21 18:27:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6gr6jdha2b...

CVE-2026-28321

creationtimestamp| type| source ---|---|--- 2026-07-21 16:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6aqgvkrk2e 2026-07-26 16:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrkra34xdm2u...

CVE-2026-28312

creationtimestamp| type| source ---|---|--- 2026-07-21 16:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ajbif3b23 2026-07-26 16:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrksvpexrs23...

CVE-2026-28308

creationtimestamp| type| source ---|---|--- 2026-07-21 16:32:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ac5ttqj2v 2026-07-26 20:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrlacu7ll72l...

CVE-2026-28302

creationtimestamp| type| source ---|---|--- 2026-07-21 16:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6a2xgjpu2r 2026-07-26 22:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrlfdry56g2y...

EUVD-2026-44394

Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability...

CVE-2024-51312

creationtimestamp| type| source ---|---|--- 2026-07-21 15:24:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr64ikpkwk22...

CVE-2026-16448

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...

EUVD-2026-46280

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...

CVE-2026-65007

creationtimestamp| type| source ---|---|--- 2026-07-21 14:51:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr62okraxs2s...

CVE-2026-8284

creationtimestamp| type| source ---|---|--- 2026-07-21 14:45:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr62dsikrz2s...

CVE-2026-16447

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multiuploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the...

CVE-2026-16448

The CVE-2026-16448 entry applies to D-Link DNS-series devices (e.g., DNS-120, DNS-320/325/327L, DNS-1550-04, etc.) up to 20260205. The affected element is function cgi_check_rsync_rw in /cgi-bin/remote_backup.cgi. Manipulating the ip argument results in a remote command injection, enabling remote...