124504 matches found
Fedora 43 : librabbitmq (2026-436ef78874)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-436ef78874 advisory. Version 0.17.0 - 2026-07-01 Security - Fix sizet overflow in amqpdecodebytes bounds check leading to out-of-bounds read GHSA- jgjf-7fwf-f3c7, 888 - Fix heap...
PT-2026-56257
Name of the Vulnerable Software and Affected Versions LocalAI affected versions not specified Description An unauthenticated server-side request forgery SSRF exists in the 'POST /models/apply' endpoint. This occurs because the endpoint passes unsanitized gallery URL fields to the...
PT-2026-105495
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper...
CVE-2026-12064
A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP SSH File Transfer Protocol or SCP Secure Copy Protocol as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect t...
GHSA-5493-9M76-2QRR
creationtimestamp| type| source ---|---|--- 2026-07-06 21:31:47+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpz22a66p72b...
CVE-2026-54760
creationtimestamp| type| source ---|---|--- 2026-07-06 21:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpyzx77jwz2l 2026-07-10 02:47:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqb534o76s2x...
CVE-2026-53486
creationtimestamp| type| source ---|---|--- 2026-07-06 21:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpyzx5z4fr2x 2026-07-12 13:01:36+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqhadhd3v72m 2026-07-14 23:28:46+00:00| seen|...
EUVD-2026-41212
Craft CMS: Sensitive File Disclosure / Server-Side File Read...
Craft CMS: Sensitive File Disclosure / Server-Side File Read
The dataUrl Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the utility:system-messages permission to embed a file-reading payload into system email templates. When those emails are sent, the server reads the target file and returns its content...
CVE-2026-55727
creationtimestamp| type| source ---|---|--- 2026-07-06 21:28:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpyzuzlayu2c...
CVE-2026-58404
Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including...
DEBIAN-CVE-2026-50134
Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...
CVE-2026-41516
creationtimestamp| type| source ---|---|--- 2026-07-06 20:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyvmfdnjw26...
CVE-2026-57573
CVE-2026-57573 affects Crawl4AI: unauthenticated SSRF via the Docker stream endpoint. Before 0.9.0, SSRF checks were only on the non‑streaming /crawl path; handle_stream_crawl_request forwarded seed URLs with no destination validation. This allowed a remote, unauthenticated client to POST to /cra...
CVE-2026-42546
creationtimestamp| type| source ---|---|--- 2026-07-06 20:02:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyv2zsuzr2w...
CVE-2026-55646
creationtimestamp| type| source ---|---|--- 2026-07-06 19:57:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyuqutnll24 2026-07-09 15:03:14+00:00| seen| https://gist.github.com/Correctover/dcf89533dd8acf055791178f2130e704 2026-07-09 15:09:36+00:00| seen|...
CVE-2026-50133
creationtimestamp| type| source ---|---|--- 2026-07-06 19:55:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyunv5kaz2v...
CVE-2026-41515
creationtimestamp| type| source ---|---|--- 2026-07-06 19:53:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyul2ihh72b...
CVE-2026-50134 Hugo: security.http.urls allow-list bypass via HTTP redirects
Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...