CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

CVE-2026-28385

CVE-2026-28385 : Canonical LXD 4.12–6.9 contains an SSRF in image import from URL sources. Authenticated users with the can_create_images entitlement can leverage the /images endpoint to trigger outbound requests from the LXD daemon, failing to validate or restrict destinations. This allows conta...

EUVD-2026-39779

Mattermost versions 10.11.x = 10.11.18, 11.6.x = 11.6.3, 11.5.x = 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Mattermost Agents plugin MCP server which allows an attacker with access to the MCP server in stdio mode to perform server-side request forgery SS...

CVE-2026-57202

creationtimestamp| type| source ---|---|--- 2026-06-26 14:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mp76evoqrj2e 2026-10-27 18:08:20+00:00| seen| https://infosec.exchange/users/cve/statuses/117514207216580062 2026-10-27 18:46:32+00:00| seen|...

CVE-2026-57925

creationtimestamp| type| source ---|---|--- 2026-06-26 14:23:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp75hf5qcd2p...

CVE-2026-55667

creationtimestamp| type| source ---|---|--- 2026-06-26 14:01:48+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp74aezucd2b 2026-07-20 22:37:35+00:00| published-proof-of-concept| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr...

CVE-2026-40711

creationtimestamp| type| source ---|---|--- 2026-06-26 13:25:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp727idquu2a...

CVE-2026-57940

CVE-2026-57940 affects HTMLy 3.1.1 and describes an SSRF in the RSS feed import. The vulnerable code path is get_feed() in system/admin/admin.php, which passes user-supplied feed_url directly to file_get_contents() without validation. An authenticated admin can exploit this by supplying a crafted...

CVE-2026-57940

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...

CVE-2026-57940

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...

Exploit for Cross-site Scripting in Docmost

CVE-2026-34212 Docmost accepted a javascript: URL inside an at...

RLSA-2026:29195 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

RLSA-2026:29703 Important: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

CVE-2026-13226

creationtimestamp| type| source ---|---|--- 2026-06-26 11:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp6swdzbgx26...

CVE-2026-1869

creationtimestamp| type| source ---|---|--- 2026-06-26 10:00:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp6oqm63do2a 2026-06-26 12:15:11+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp6wbqixpl22...

CVE-2026-57877

creationtimestamp| type| source ---|---|--- 2026-06-26 09:15:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp6ma3ng532x...

CVE-2017-4997

creationtimestamp| type| source ---|---|--- 2026-06-26 09:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp6lrgnmto2h...

CVE-2026-39830

creationtimestamp| type| source ---|---|--- 2026-06-26 07:43:14+00:00| seen| https://gist.github.com/alon710/88958f43b0e7690b6916b9cfa5c9b9df 2026-07-15 16:40:07+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mqp5wvyuvz2h 2026-09-03 06:10:05+00:00| seen|...

CVE-2017-14507

creationtimestamp| type| source ---|---|--- 2026-06-26 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp6bpkzf2u2y...

Malicious code in react-context-form-tdsss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a53e75a65681ee9ea818634ddee1ed52c6c8398dbd68e2b6abca255b24aaf37 [email protected] is a dependency-confusion payload. package.json declares scripts.preinstall="node index.js", and index.js issues an...