124159 matches found
PT-2026-63307
Name of the Vulnerable Software and Affected Versions Gitea versions 1.26.4 and earlier Description The restore-repo CLI command fails to properly validate the Head.CloneURL field when parsing pull request.yml from a repository dump. The safety check function CheckAndEnsureSafePR is called with a...
Oracle Linux 10 : python3.12 (ELSA-2026-39183)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39183 advisory. 3.12.13-2.0.1.el102.1 - Remove upstream URL reference 3.12.13-2.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 Tenable has extracted the preceding...
CVE-2026-57495
creationtimestamp| type| source ---|---|--- 2026-07-20 23:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4icrfnis2e...
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslash were not recognized as internal paths, so the handler would echo the raw path back...
CVE-2026-64651
creationtimestamp| type| source ---|---|--- 2026-07-20 22:40:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4eghjh6n2i...
CVE-2026-44509
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4e5isavb2q...
CVE-2026-64626
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...
GHSA-G6XQ-892H-64W3 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...
CVE-2026-64626
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...
CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...
EUVD-2026-44672
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import...
CVE-2026-60028
creationtimestamp| type| source ---|---|--- 2026-07-20 21:39:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4ayi6xas2o...
Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...
EUVD-2026-42336
Mistune renderers/html.safeurl: HARMFULPROTOCOLS list misses legacy and chained schemes that historically chain to javascript: execution...
GHSA-QFRW-5RXM-MHH2 Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution
Summary Type: URL-scheme allowlist gap. The safeurl filter only blocks the four schemes javascript:, vbscript:, file:, data:. Several other schemes are accepted into rendered and tags despite being known XSS vectors in legacy or chain-handling browsers. The same gap applies to direct links,...
Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...
GHSA-8C25-4J27-2RV3 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()
Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...