123361 matches found
CVE-2026-53668: URL Redirection to Untrusted Site
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has...
CVE-2017-11013
creationtimestamp| type| source ---|---|--- 2026-07-26 07:01:57+00:00| seen| https://t.me/KaitNews/6245 2026-07-27 00:01:39+00:00| seen| https://t.me/KaitNews/6245 2026-07-29 07:00:09+00:00| seen| https://t.me/KaitNews/6245 2026-07-30 00:03:11+00:00| seen| https://t.me/KaitNews/6245...
CVE-2017-5709
creationtimestamp| type| source ---|---|--- 2026-07-26 07:01:54+00:00| seen| https://t.me/KaitNews/6821 2026-07-27 00:01:37+00:00| seen| https://t.me/KaitNews/6821 2026-07-29 05:00:05+00:00| seen| https://t.me/KaitNews/6821 2026-07-30 00:03:15+00:00| seen| https://t.me/KaitNews/6821...
gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL
A flaw was found in GitPython. A remote attacker can exploit a vulnerability in the Repo.clonefrom method by providing a specially crafted Git repository URL. This URL can contain references to environment variables, which are then expanded and included in the URL. This allows the attacker to...
CVE-2023-35642
creationtimestamp| type| source ---|---|--- 2026-07-26 02:02:17+00:00| seen| https://t.me/EchelonEyes/2269 2026-07-27 00:00:54+00:00| seen| https://t.me/EchelonEyes/2269 2026-07-28 00:00:33+00:00| seen| https://t.me/EchelonEyes/2269...
GHSA-86CX-WWF4-PHQ4
creationtimestamp| type| source ---|---|--- 2026-07-25 15:32:47+00:00| seen| https://gist.github.com/alon710/341e4798332dfd78cba00be899ecacf7...
CVE-2026-66140
creationtimestamp| type| source ---|---|--- 2026-07-25 11:00:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhpmrowqe2d...
CVE-2026-14603
creationtimestamp| type| source ---|---|--- 2026-07-25 10:00:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhmbkn5gq2e...
CVE-2026-49744
creationtimestamp| type| source ---|---|--- 2026-07-25 09:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrhiwmjagk2d...
GHSA-3R53-75J5-3G7J
creationtimestamp| type| source ---|---|--- 2026-07-25 06:31:04+00:00| seen| https://gist.github.com/alon710/31362352a2fade2501771882d0062b85...
CVE-2026-61892
creationtimestamp| type| source ---|---|--- 2026-07-25 00:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrgkqha7la22...
CVE-2026-48144
creationtimestamp| type| source ---|---|--- 2026-07-24 23:22:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgin3c4se24 2026-07-27 14:02:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn2pfmtd62e 2026-07-28 14:37:06+00:00| seen|...
CVE-2026-64212
creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:48+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116977339433684369 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...
CVE-2026-66138
creationtimestamp| type| source ---|---|--- 2026-07-24 22:33:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrgfv6yufv25...
GHSA-94P4-4CQ8-9G67 GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Summary The fix for GHSA-rwj8-pgh3-r573 stopped Repo.clonefrom from running caller-supplied URLs through os.path.expandvars, but it guarded only that one caller. Remote.create — reached from the public Repo.createremote and its Remote.add alias — still passes an attacker-influenceable URL through...
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
Summary The fix for GHSA-rwj8-pgh3-r573 stopped Repo.clonefrom from running caller-supplied URLs through os.path.expandvars, but it guarded only that one caller. Remote.create — reached from the public Repo.createremote and its Remote.add alias — still passes an attacker-influenceable URL through...
Server-side Request Forgery (SSRF)
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the uploadUrl function when processing attachment column values during AI table generation. An attacker can access internal network resources and sensitive...
GHSA-HFHX-W8P8-4HC7 Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Budibase: SSRF via bare fetch in uploadUrl during AI table generation Summary The uploadUrl function in packages/server/src/utilities/fileUtils.ts uses a bare fetchurl call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachmen...
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
Budibase: SSRF via bare fetch in uploadUrl during AI table generation Summary The uploadUrl function in packages/server/src/utilities/fileUtils.ts uses a bare fetchurl call without any SSRF protection. This function is invoked when the AI table generation feature processes LLM-generated attachmen...