Astro Framework isInternalPath Phishing

The vulnerability of the isInternalPath function in the web framework Astro relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability could allow a remote attacker to carry out phishing attacks...

PT-2026-76533

On Unix platforms handled by src/unix.rs, affected versions substitute the caller-supplied URL into the BROWSER environment-variable template before tokenizing the resulting string with split ascii whitespace. If an application passes an attacker-controlled non-HTTPS URL whose parsed form retains...

NewStart CGSL MAIN 6.06 : docker-image-check Multiple Vulnerabilities (NS-SA-2026-0055)

The remote NewStart CGSL host, running version MAIN 6.06, has docker-image-check packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications...

CVE-2026-49258

creationtimestamp| type| source ---|---|--- 2026-07-28 23:00:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqjasdbre2q...

CVE-2026-14974

creationtimestamp| type| source ---|---|--- 2026-07-28 22:57:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqj3vwx3u2q 2026-07-30 05:15:09+00:00| seen| https://www.hkcert.org/security-bulletin/ibm-websphere-products-multiple-vulnerabilities20260730...

CVE-2026-14973

creationtimestamp| type| source ---|---|--- 2026-07-28 22:55:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqixfdrvf2a 2026-07-28 23:46:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqlslhnyj2j 2026-07-29 02:03:47+00:00| seen|...

openhole-server vulnerable to path traversal via URL-decoded request path

Summary openhole-server forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of the original request-target. Percent-encoded dot-segments %2e and separators %2f were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but...

CVE-2026-54691

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-66064

goshs is affected by an ACL/Path Traversal vulnerability in the httpserver/handler.go sendFile logic prior to version 2.1.5. The authorization filename was derived from raw req.URL.Path while using a cleaned path for file access, allowing a trailing slash to bypass .goshs ACL-file protection and ...

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

Summary JSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a...

GHSA-954P-556P-R752 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

Summary JSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a...

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

GHSA-RFR2-MQ9M-X2QX datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Summary datamodel-code-generator's built-in HTTP fetcher http.getbody issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and followredirects=True. Loopback addresses, RFC1918 ranges, link-local 169.254.169.2...

CVE-2026-54691

CVE-2026-54691 affects datamodel-code-generator prior to 0.61.0; the http.get_body function in src/datamodel_code_generator/http.py accepts --url targets and redirect chains without host/IP validation, enabling server-side request forgery to loopback, private, link-local, metadata, and other netw...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-50737

creationtimestamp| type| source ---|---|--- 2026-07-28 20:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqa6orpmn2k...

CVE-2026-51267

creationtimestamp| type| source ---|---|--- 2026-07-28 20:16:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqa35kalo2r 2026-07-29 12:02:45+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrruxvmoo42o...

GHSA-VCHH-R53J-8MPW Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...

EUVD-2026-36073

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks...

Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...