CVE-2026-6330

creationtimestamp| type| source ---|---|--- 2026-06-25 22:25:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hvwozge27...

CVE-2026-11800

creationtimestamp| type| source ---|---|--- 2026-06-25 22:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hhhr7qa2r 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:32+00:00| seen|...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the improper handling of user-supplied URLs in the acmeurl parameter, lack of access control in the certificate key-fetch process, and...

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via...

Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF

Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...

CVE-2026-6092

creationtimestamp| type| source ---|---|--- 2026-06-25 21:55:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5galeomc27...

CVE-2026-6325

creationtimestamp| type| source ---|---|--- 2026-06-25 21:53:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5g5lm4ac2w...

CVE-2026-12473 OHIF Viewers DICOM Server-Side request forgery

Two data sources DICOMWebProxy and DICOMJSON shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the...

CVE-2017-14876

creationtimestamp| type| source ---|---|--- 2026-06-25 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp56j2cdy62r...

CVE-2026-56771

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

CVE-2017-16614

creationtimestamp| type| source ---|---|--- 2026-06-25 19:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp54tesowb2n...

GO-2026-5310 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp

Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp...

GO-2026-5351 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno

Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno...

GO-2026-5294 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) in github.com/juev/nebula-mesh

nebula-mesh: Newly-minted operator API key exposed in redirect URL Referer, history, proxy logs in github.com/juev/nebula-mesh...

CVE-2017-17766

creationtimestamp| type| source ---|---|--- 2026-06-25 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp535qfbmo2e...

GO-2026-5108 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall...

GO-2026-5141 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel

Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel...

CVE-2026-6091

creationtimestamp| type| source ---|---|--- 2026-06-25 18:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zzxq2wn2f...

CVE-2026-9179

creationtimestamp| type| source ---|---|--- 2026-06-25 18:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4zy7pl6f2w...

CVE-2026-55697

creationtimestamp| type| source ---|---|--- 2026-06-25 18:13:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4ztxnb3j2o 2026-06-27 00:35:14+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27x...