65335 matches found
CVE-2026-9169
creationtimestamp| type| source ---|---|--- 2026-08-07 10:06:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/b27ssjpfbtrcr...
CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality
Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...
CVE-2026-54205
Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...
CVE-2026-54205
The vulnerability CVE-2026-54205 affects Tobit Laboratories AG TeamDavid’s Webbox link-storing functionality. The server-side code accepts a pathname parameter that can be a UNC network location (e.g., \Server\Share) without validation, causing outbound connections to attacker-controlled SMB endp...
EUVD-2026-54447
Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting XSS vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the...
CVE-2026-54199 TeamDavid: Header Injection through request body in link storing functionality
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...
CVE-2026-54199
Tobit Laboratories AG TeamDavid’s Webbox is vulnerable to HTTP header injection via the request body in the link-storing function (//ServerClient_celink.htm), which is appended to the redirect target in the 302 response. Inserting a line feed can propagate into the redirect URL, enabling control ...
EUVD-2026-54431
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing functionality //ServerClientcelink.htm, which is appended to the redirect target in the 302 HTTP response. If a line feed is added, this will also be added to...
CVE-2026-9169 LUCID Vision Labs: DLL Search Order Hijacking in Arena SDK 1.0.80.49 on Windows
DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...
GHSA-PMHH-3W7G-XQP8
creationtimestamp| type| source ---|---|--- 2026-08-07 08:33:25+00:00| seen| https://gist.github.com/alon710/b4340b7774927252fafb9cfdb5e51a49...
CVE-2026-17505
creationtimestamp| type| source ---|---|--- 2026-08-07 06:03:16+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-17505.yaml 2026-08-08 00:02:14+00:00| confirmed|...
CVE-2026-15386 Meow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-Text
The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds for linked galleries, allowing users with the Author role or above to store a JavaScript payload that executes in the browser of any visitor includi...
CVE-2026-15032 wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion
The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...
CVE-2026-49163
creationtimestamp| type| source ---|---|--- 2026-08-07 05:00:06+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mshrkg7rfy2g 2026-08-07 15:12:52+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117054869893780449 2026-08-11 19:00:39+00:00| seen|...
CVE-2026-70559
creationtimestamp| type| source ---|---|--- 2026-08-07 05:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96974 2026-08-07 10:15:04+00:00| published-proof-of-concept| Telegram/WS6QG7O3daDhEGVi670FSZbAHcCdG6YEmYMAs3H7lOdyiY 2026-08-07 16:02:15+00:00| seen|...
GHSA-HMQG-CXWW-WQHQ
creationtimestamp| type| source ---|---|--- 2026-08-07 04:31:19+00:00| seen| https://gist.github.com/alon710/a294e95161c29ae2353666d3ed774930...
CVE-2026-19149
creationtimestamp| type| source ---|---|--- 2026-08-07 02:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mshkmnjejr2z 2026-08-07 04:46:06+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260807 2026-08-13 09:46:45+00:00| seen|...
GHSA-RVMM-V933-JGXQ
creationtimestamp| type| source ---|---|--- 2026-08-07 01:35:03+00:00| seen| https://gist.github.com/alon710/44b00a029eb5e56bac1f996f02574592...
CVE-2026-5857
creationtimestamp| type| source ---|---|--- 2026-08-07 00:37:02+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3mshctz6ra52l 2026-08-10 02:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msoywprfwe23...