CVE-2026-17348

creationtimestamp| type| source ---|---|--- 2026-08-04 12:51:49+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb2j4r4hv2k...

PYSEC-2026-3620 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

HMAC validation bypass via multiple .replace calls when removing URL signature Summary Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can...

PYSEC-2026-3571 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Summary The standalone flyto-verification service exposes POST /run with no authentication, on all interfaces 0.0.0.0:8344 per the shipped Dockerfile. The request body's callbackurl is used verbatim for an outbound POST that unconditionally attaches X-Internal-Key: $FLYTORUNNERSECRET. The...

PYSEC-2026-3573 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Summary llm.chat reads the operator's provider key from the environment OPENAIAPIKEY, ANTHROPICAPIKEY, ... and sends it in the Authorization: Bearer header to baseurl, a parameter the caller controls. baseurl is only checked against the SSRF guard, and the guard allows any public host, so pointin...

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

SummaryNumerous HTTP-emitting modules core.api.httpget, core.api.httppost, graphql.query/graphql.mutation, monitor.httpcheck, communication.slacksend, notification.discord,slack,teams.sendmessage, ai.visionanalyze anthropic path, verify.visualdiff, browser.proxyrotate, and the agent/llm inline...

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Summaryllm.chat reads the operator's provider key from the environment OPENAIAPIKEY, ANTHROPICAPIKEY, ... and sends it in the Authorization: Bearer header to baseurl, a parameter the caller controls. baseurl is only checked against the SSRF guard, and the guard allows any public host, so pointing...

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summarydatamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.25...

scdlbot (0.15.0), vk-url-scraper (0.3.15) +1 more potentially affected by CVE-2026-55404 via yt-dlp (2023.2.17)

yt-dlp PYPI version 2023.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - scdlbot 0.15.0 - vk-url-scraper 0.3.15 - ytb-downloader 0.3.1 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

vk-url-scraper (>=0.2.1, <=0.3.5) potentially affected by CVE-2026-55404 via yt-dlp (2022.5.18)

yt-dlp PYPI version 2022.5.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper =0.2.1, =0.3.5 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

basketcase (3.0.2), gridplayer (0.4.3) +1 more potentially affected by CVE-2026-55404 via yt-dlp (2022.7.18)

yt-dlp PYPI version 2022.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 3.0.2 - gridplayer 0.4.3 - vk-url-scraper =0.3.8, =0.3.10 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

PYSEC-2026-3622 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Summary If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut...

vk-url-scraper (0.3.30) potentially affected by CVE-2026-55404 via yt-dlp (2024.7.15.232803.dev0)

yt-dlp PYPI version 2024.7.15.232803.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper 0.3.30 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

GHSA-3F7W-8RR8-F37F

creationtimestamp| type| source ---|---|--- 2026-08-04 08:31:39+00:00| seen| https://gist.github.com/alon710/e29226c330282c9416a9859028fe2877 2026-08-17 15:00:04+00:00| seen| https://t.me/bdufstecru/3388 2026-08-18 00:00:28+00:00| published-proof-of-concept| https://t.me/bdufstecru/3388...

CVE-2026-16296

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

CVE-2026-39932

creationtimestamp| type| source ---|---|--- 2026-08-04 06:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msadtmns5w2m...

CVE-2026-69085

creationtimestamp| type| source ---|---|--- 2026-08-04 06:02:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msadmgspwc2o 2026-10-01 14:38:48+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-33jq-p8c2-q3q4 2026-10-01 16:35:53+00:00| seen|...

EUVD-2026-52598

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

CVE-2026-16296

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...