Directory Traversal

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Directory Traversal via the fileloader process. An attacker can access arbitrary files outside the intended directory by supplying specially crafted,...

EUVD-2026-51612

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

Division by zero

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Division by zero via the convolution filter process in the C extension when user-controlled input is used as a divisor without validation. An attacker can cause...

Improper Verification of Cryptographic Signature

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the URL signature removal process. An attacker can manipulate the validated URL and bypass intended access...

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

HMAC validation bypass via multiple .replace calls when removing URL signature Summary Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can...

CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-53501

Thumbor (open-source image thumbnail service by globo.com) is affected prior to version 7.8.0. The vulnerability stems from using Python’s .replace() to strip the signature from the URL before HMAC validation, which removes all occurrences of the substring. An attacker can insert the same signatu...

CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-57232

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-34490

creationtimestamp| type| source ---|---|--- 2026-07-31 18:14:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/b3ngk6uz6mptu...

EUVD-2026-51594

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...

CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...

CVE-2026-18481

CVE-2026-18481 describes a stored cross-site scripting flaw in the AWS Ops Wheel project, affecting the participant_url handling. The issue, triggered by a crafted participant_url value with a dangerous URI scheme, could allow an authenticated remote user to steal session tokens and escalate to f...

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer...

CVE-2026-12942

creationtimestamp| type| source ---|---|--- 2026-07-31 17:06:30+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrxguvdzja2v...

CVE-2026-17059

creationtimestamp| type| source ---|---|--- 2026-07-31 17:04:16+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3mrxgquksow2h...

CVE-2026-52855

creationtimestamp| type| source ---|---|--- 2026-07-31 17:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgqloluu2j 2026-07-31 17:54:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2cyzi3feyud55 2026-07-31 19:49:55+00:00| seen|...

GHSA-G956-2F74-RMV7 hashi-vault-js has a path traversal and query parameter injection

Summary The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject...

CVE-2026-17347

creationtimestamp| type| source ---|---|--- 2026-07-31 17:01:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxgl4s7yf2a 2026-08-01 09:52:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz73zqg4s2m 2026-08-01 09:53:08+00:00| seen|...