GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Summary Repo.clonefrom passes the caller-supplied remote URL through Git.polishurl, which on every non-Cygwin platform calls os.path.expandvars on the URL before handing it to git clone. An attacker who controls the URL argument — the documented use case for clonefrom in "import repository from...

CVE-2026-46989

creationtimestamp| type| source ---|---|--- 2026-07-21 22:06:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sxgxqu62j 2026-07-23 16:45:33+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 15:07:07+00:00| seen|...

CVE-2026-46983

creationtimestamp| type| source ---|---|--- 2026-07-21 22:06:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sxf46fe2e 2026-07-23 16:45:24+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: or vbscript: URIs when the scheme is split by a numeric character reference that has no trailing semicolon. A browser decodes such references and resolves the URL to an executable javascript: scheme, while alloweduri?...

CVE-2026-46876

creationtimestamp| type| source ---|---|--- 2026-07-21 22:02:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sqbmfcn2v 2026-07-23 16:45:05+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 10:07:07+00:00| seen|...

CVE-2026-35290

creationtimestamp| type| source ---|---|--- 2026-07-21 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sq7map423 2026-07-23 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 09:37:06+00:00| seen|...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-8986

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-56654

creationtimestamp| type| source ---|---|--- 2026-07-21 21:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ppnqxbj2r 2026-07-21 22:36:25+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-683j-3ff6-hh2x...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

GHSA-5GGR-2F2H-JMVM Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the restore-repo when parsing the pullrequest.yml file. An attacker can cause the server to initiate network requests to arbitrary URLs or disclose local git repositories by supplying a crafted...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the restore-repo when parsing the pullrequest.yml file. An attacker can cause the server to initiate network requests to arbitrary URLs or disclose local git repositories by supplying a crafted...

CVE-2026-63764

LMDeploy prior to 0.14.0 contains a server-side request forgery (SSRF) in the _load_http_url function of the media handler. The private-IP guard validates only the original URL; after HTTP redirects, hosts are not re-validated. An unauthenticated attacker can submit a crafted image_url to the cha...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

GHSA-X77V-Q46J-393G Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Summary When oauth2client UPDATEAVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim. The affected code path calls http.Geturl without...

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Summary When oauth2client UPDATEAVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim. The affected code path calls http.Geturl without...

CVE-2016-20096

creationtimestamp| type| source ---|---|--- 2026-07-21 19:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6lov4zwt2a 2026-07-21 23:16:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6wuxjfgp23...