124548 matches found
CVE-2026-8378
creationtimestamp| type| source ---|---|--- 2026-06-23 08:16:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowxko6srr2l...
Improper Access Control
LangGraph Python SDK is vulnerable to Improper Access Control. The vulnerability is due to unsafe URL path construction using unsanitized user-supplied identifiers, where special characters in identifier values can alter the intended request path and target unintended resources, allowing attacker...
CVE-2026-55654
creationtimestamp| type| source ---|---|--- 2026-06-23 07:53:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mowwbexkdi2a 2026-10-13 10:19:23+00:00| seen| MISP/f8adec39-0b02-47ba-9542-6b9dafe336bd...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 — PoC: Path Traversal + RCE via modcgi So...
CVE-2026-41523
creationtimestamp| type| source ---|---|--- 2026-06-23 02:37:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3moweld2smf2l 2026-06-23 05:13:50+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mowndjk4ct2x...
CVE-2026-47155
creationtimestamp| type| source ---|---|--- 2026-06-23 01:10:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow7pttdok2k...
CVE-2026-54232
creationtimestamp| type| source ---|---|--- 2026-06-23 01:05:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow7gveg3u2j 2026-07-01 11:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mplgiawmxa2x...
CVE-2026-48109
creationtimestamp| type| source ---|---|--- 2026-06-23 00:26:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow5avfblh2o 2026-07-20 06:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mr2olcg7es2s 2026-07-22 14:54:29+00:00| seen|...
OSV-2026-959 Heap-use-after-free in Wt::Http::Request::parseFormUrlEncoded
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=526224351 Crash type: Heap-use-after-free READ 8 Crash state: Wt::Http::Request::parseFormUrlEncoded Wt::CgiParser::parse fuzz-cgi.C...
CVE-2026-50023: Improper Restriction of Names for Files and Other Resources
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitl...
CVE-2026-56275: Server-Side Request Forgery (SSRF)
Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...
CVE-2026-47377: URL Redirection to Untrusted Site
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashRedirect plugin called window.location.replace on a path extracted from the URL hash fragment after only checking hashPath.startsWith'/'. Protocol-relative URLs //attacker.com/… also satisfy that...
PT-2026-51607
Name of the Vulnerable Software and Affected Versions Poweradmin versions prior to 4.2.4 Poweradmin versions prior to 4.3.3 Description Poweradmin is a web-based DNS administration tool for PowerDNS server. The software uses the attacker-controlled HTTP HOST request header as the authoritative...
CVE-2026-47387: Improper Neutralization of Input During Web Page Generation
NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view submit handler packages/nc-gui/composables/useSharedFormViewStore.ts in NocoDB writes the form's redirecturl to window.location.href after a same-host check that does not validate the URL scheme. A...
Flask-Security has an Open Redirect issue
flasksecurity.utils.validateredirecturl can allow an attacker-controlled redirect URL when subdomain redirects are enabled. The bypass uses a backslash inside the URL authority/host: text http://evil.com.whitelist.com http://evil.com%5C.whitelist.com Python's urlsplit parses the full authority as...
CVE-2026-46553: Allocation of Resources Without Limits or Throttling
NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL path did not enforce NCATTACHMENTFIELDSIZE against either the remote file's advertised Content-Length or the decoded length of a data: URI, allowing an authenticated user to bypass the configured...
CVE-2026-54264
creationtimestamp| type| source ---|---|--- 2026-06-22 23:32:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow2atv7uv2q 2026-07-18 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqwza72rln2m...
CVE-2026-50168
creationtimestamp| type| source ---|---|--- 2026-06-22 23:29:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mow24eiu5p2q...
GHSA-35C4-RVC8-FRHM Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
Summary The Budibase server route POST /api/attachments/:datasourceId/url packages/server/src/api/routes/static.ts is registered with only the recaptcha middleware. There is no authorized... middleware in the chain. The controller...
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
Summary The Budibase server route POST /api/attachments/:datasourceId/url packages/server/src/api/routes/static.ts is registered with only the recaptcha middleware. There is no authorized... middleware in the chain. The controller...