66492 matches found
CVE-2026-35020
CVE-2026-35020 entry is rejected/not used by the CNA.
CVE-2026-35166
A flaw was found in Hugo, a static site generator. This vulnerability arises from improper escaping of links and image links within the default markdown to HTML renderer. A remote attacker could exploit this by crafting malicious markdown content, potentially leading to information disclosure or...
CVE-2026-35029
creationtimestamp| type| source ---|---|--- 2026-04-06 18:32:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitvlluyaz24 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM 2026-04-16 00:07:28+00:00| seen|...
CVE-2026-34992
creationtimestamp| type| source ---|---|--- 2026-04-06 18:19:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mituubi63e2i 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM...
CVE-2026-35030
creationtimestamp| type| source ---|---|--- 2026-04-06 18:17:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mituq7dnbv2g 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM 2026-04-16 00:07:28+00:00| seen|...
CVE-2026-35166
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in...
UBUNTU-CVE-2026-35166
Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in...
CVE-2026-35046
creationtimestamp| type| source ---|---|--- 2026-04-06 18:11:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitug4jdp62i...
CVE-2026-35047
creationtimestamp| type| source ---|---|--- 2026-04-06 18:08:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mituac6cnv25 2026-04-06 19:29:29+00:00| published-proof-of-concept| Telegram/0wjdVVOdHVRh-NR-AUdnOvXJcqqbi6lE8Vl80iGy2s6Zy0...
GHSA-X3F4-V83F-7WP2 Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri
Hi, I found that 6 endpoints in Authorizer accept a user-controlled redirecturi and append sensitive tokens to it without validating the URL against AllowedOrigins. The OAuth /app handler validates redirecturi at httphandlers/app.go:46, but the GraphQL mutations and verifyemail handler skip...
Open Redirect
Overview Affected versions of this package are vulnerable to Open Redirect through the redirecturi parameter in multiple endpoints ForgotPassword, MagicLinkLogin, Signup, InviteMembers, OAuthLoginHandler, VerifyEmailHandler which is not validated against AllowedOrigins. An attacker can obtain...
Authorizer: Password reset token theft and full auth token redirect via unvalidated redirect_uri
Hi, I found that 6 endpoints in Authorizer accept a user-controlled redirecturi and append sensitive tokens to it without validating the URL against AllowedOrigins. The OAuth /app handler validates redirecturi at httphandlers/app.go:46, but the GraphQL mutations and verifyemail handler skip...
Authorizer: CQL/N1QL Injection in Cassandra and Couchbase Backends via fmt.Sprintf String Interpolation
Vulnerability Details CWE: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic All 66+ CQL queries in internal/storage/db/cassandradb/ use fmt.Sprintf to interpolate user-controlled values directly into CQL query strings without parameterization. Unauthenticated endpoints...
GHSA-5GHQ-42RG-769X CI4MS: Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
An attacker can acheive Full Account Takeover & Privilege Escalation via Stored DOM Blind XSS on public-facing landing pages through the System Settings Company Information section which allows the injection of XSS payloads...
CVE-2026-0740
creationtimestamp| type| source ---|---|--- 2026-04-06 17:19:46+00:00| seen| https://bsky.app/profile/wordfenceofficial.bsky.social/post/3mitrjp4tp22q 2026-04-07 05:17:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miuzmkuxzz2r 2026-04-07 05:30:31+00:00| seen|...
CVE-2025-47390
creationtimestamp| type| source ---|---|--- 2026-04-06 17:16:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitrdd5ovk2r 2026-04-06 17:31:14+00:00| seen| Telegram/DvHhUeNPzeGTU1g3nAXVjr06ieUowQjpdSlFc2J0jcODus 2026-04-09 03:40:09+00:00| seen|...
CVE-2026-31063
creationtimestamp| type| source ---|---|--- 2026-04-06 16:31:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116358713535158087...
CVE-2019-25684
creationtimestamp| type| source ---|---|--- 2026-04-06 15:14:17+00:00| seen| https://infosec.exchange/ap/users/116075764941463905/statuses/116358406102447084 2026-04-09 21:37:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mj3rcqekpf2f...