CVE-2026-16635

creationtimestamp| type| source ---|---|--- 2026-08-01 09:56:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/66q5dtaf7v7nu 2026-08-01 11:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzcwrcpne2a 2026-08-01 17:34:50+00:00| seen|...

CVE-2026-15450

creationtimestamp| type| source ---|---|--- 2026-08-01 09:50:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dzh6iyuwq4bgt 2026-08-01 11:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzcwxodbd2z...

CVE-2026-17346

creationtimestamp| type| source ---|---|--- 2026-08-01 09:37:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz6a6dk422x 2026-08-01 09:37:06+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrz6a6s6tm24 2026-08-02 08:00:28+00:00| seen|...

CVE-2026-51277

creationtimestamp| type| source ---|---|--- 2026-08-01 01:15:04+00:00| seen| https://gist.github.com/programmervuln/9c0274656cf88c341069fb99bf08ea6f 2026-08-01 01:16:31+00:00| seen| https://gist.github.com/programmervuln/4d53816d40d5dacd9cceefa2fe896598...

CVE-2026-53500

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

GHSA-6X26-6R6F-M537 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

EUVD-2026-51597

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-53500

Thumbor (open-source image service by globo.com) is affected prior to version 7.8.0 where ALLOWED_SOURCES is applied by re.match() to unescaped strings, enabling a hostname with dot-position differences to bypass the allowlist. Root cause: unescaped patterns treated as normal strings in a regex m...

CVE-2026-67822

creationtimestamp| type| source ---|---|--- 2026-07-31 18:12:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5cbbr7n7dy7lz 2026-07-31 19:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxnh5mze42a 2026-08-08 23:28:21+00:00| seen|...

CVE-2026-17566

creationtimestamp| type| source ---|---|--- 2026-07-31 17:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxgkvuq372u 2026-07-31 17:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgqkc5lt2i 2026-08-01 15:04:27+00:00| seen|...

CVE-2026-39448

creationtimestamp| type| source ---|---|--- 2026-07-31 10:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrwrj4bj7s2n 2026-07-31 11:00:06+00:00| seen| https://bsky.app/profile/potato.software/post/3mrwsfnlpr62c...

CVE-2026-51247

creationtimestamp| type| source ---|---|--- 2026-07-31 06:40:55+00:00| seen| https://gist.github.com/programmervuln/d80518c782a43c1e4f07f22dbe4e04af 2026-07-31 06:42:22+00:00| seen| https://gist.github.com/programmervuln/bcc821b1a7ded9811e6996e0633b7e1c...

CVE-2026-51242

creationtimestamp| type| source ---|---|--- 2026-07-31 03:06:05+00:00| seen| https://gist.github.com/programmervuln/3795f1645c26047a1b358cb7159ceafc 2026-07-31 03:10:09+00:00| seen| https://gist.github.com/programmervuln/87b90903788d5ad7cfc29a83af254244 2026-07-31 03:45:05+00:00| seen|...

CVE-2026-68502

creationtimestamp| type| source ---|---|--- 2026-07-30 22:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvgudm3vn23 2026-07-30 22:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvh244ih32q 2026-07-30 23:04:15+00:00| seen|...

GHSA-HF3J-86P7-MFW8

creationtimestamp| type| source ---|---|--- 2026-07-30 21:31:48+00:00| seen| https://gist.github.com/alon710/2558fd727c5d711082968032190a8577 2026-07-30 21:38:54+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mrvfmzyzxd23...

CVE-2026-61536

creationtimestamp| type| source ---|---|--- 2026-07-30 19:54:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ijlhn7uk5lbef 2026-07-30 20:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva5o4eg52q...

CVE-2026-18245

creationtimestamp| type| source ---|---|--- 2026-07-30 19:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv4y6hato2z 2026-07-30 19:04:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bovzhqup4waot 2026-07-30 20:01:52+00:00| seen|...

CVE-2026-46678

A flaw was found in Pydantic AI, a Python agent framework for building Generative AI applications. When an application is configured to allow local file downloads from untrusted URLs, a Server-Side Request Forgery SSRF vulnerability exists. This flaw allows an attacker to bypass existing security...