CVE-2026-17534

Kimi Code fetch path FetchURL is vulnerable before 0.27.0: it hardens SSRF protection with a static hostname and IP-literal denylist in assertSafeFetchTarget but does not resolve DNS or re-validate after HTTP redirects. An attacker who can influence a FetchURL call (e.g., via prompt injection) ca...

CVE-2026-17534 Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects

Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...

CVE-2026-14957

creationtimestamp| type| source ---|---|--- 2026-07-27 08:30:35+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116991002509583973 2026-09-02 05:01:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muj5qf4wef2q 2026-10-14 16:02:00+00:00| seen|...

CVE-2026-48354

creationtimestamp| type| source ---|---|--- 2026-07-27 08:30:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmi5p2yhe27...

CVE-2026-14236

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-64410

creationtimestamp| type| source ---|---|--- 2026-07-27 06:22:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmayuss522y 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-64392

creationtimestamp| type| source ---|---|--- 2026-07-27 06:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmarpnodf2s 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-64384

creationtimestamp| type| source ---|---|--- 2026-07-27 06:14:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmakkgqiq2z 2026-09-02 04:45:25+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260902 2026-09-15 12:46:43+00:00|...

CVE-2026-64385

creationtimestamp| type| source ---|---|--- 2026-07-27 06:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmagzepio2j 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-64383

creationtimestamp| type| source ---|---|--- 2026-07-27 06:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrmadhn6kl2v 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-64268

creationtimestamp| type| source ---|---|--- 2026-07-27 06:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrm7yq3mge2s 2026-08-06 04:48:04+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260806 2026-09-08 20:45:59+00:00|...

CVE-2026-14236

The Contact Form 7 – PayPal & Stripe Add-on WordPress plugin (versions before 2.5 ) is vulnerable to an Open Redirect vulnerability. The root cause is a failure to validate the host of a user-supplied return URL, which is used as the success and cancel redirect targets during a Stripe checkout fl...

CVE-2026-14236 Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

PT-2026-65079

Name of the Vulnerable Software and Affected Versions Plack::App::Prerender versions prior to 0.3.0 Description An issue exists where the software can proxy requests to an arbitrary host due to unvalidated concatenation of the REQUEST URI in the call function. When the rewrite base is a plain...

PT-2026-65358

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write in code.gitea.io/gitea...

CVE-2026-59730: URL Redirection to Untrusted Site

Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailingSlash: 'always' is configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslas...

CVE-2026-65618: Server-Side Request Forgery (SSRF)

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data...

CVE-2026-51564: URL Redirection to Untrusted Site

An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...

CVE-2026-14236: URL Redirection to Untrusted Site

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...

CVE-2026-53668: URL Redirection to Untrusted Site

React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has...