CVE-2026-67430

creationtimestamp| type| source ---|---|--- 2026-07-29 20:53:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrssmrex5o2o 2026-07-30 16:35:25+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh 2026-07-31...

CVE-2026-63118

creationtimestamp| type| source ---|---|--- 2026-07-29 20:51:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrssjm3jv424 2026-07-30 16:35:30+00:00| published-proof-of-concept| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m 2026-07-31...

CVE-2026-4672

creationtimestamp| type| source ---|---|--- 2026-07-29 20:49:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrssgmegbl2i 2026-07-30 04:45:40+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260730 2026-07-30 14:15:31+00:00| seen|...

CVE-2026-5057

creationtimestamp| type| source ---|---|--- 2026-07-29 20:48:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrssdrpgf22a 2026-07-30 02:01:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtdsycxab2o...

CVE-2026-3093

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-67436

CVE-2026-67436 affects Linuxfabrik monitoring-plugins (6.0.0 and earlier), specifically the redfish-* plugins. The root cause is that these plugins build request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, enabling a malicious or compromised BMC to ...

CVE-2026-13346

creationtimestamp| type| source ---|---|--- 2026-07-29 19:33:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrso5c35vn24...

CVE-2026-59083

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

AZL-94335 CVE-2026-13346 affecting package python-pip 24.2-9

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

AZL-94353 CVE-2026-13346 affecting package python-virtualenv 20.36.1-5

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

CVE-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

EUVD-2026-50486

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-3093

GitLab CE/EE contains a Cross-site Scripting (XSS) flaw (CVE-2026-3093) caused by improper sanitization of user-controlled input during web page generation. Affected versions are 14.0 up to 19.0.4, 19.1 up to 19.1.2, and 19.2 up to 19.2.0. Under certain conditions, an attacker could trigger arbit...

CVE-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-3093

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-67428

The CVE-2026-67428 entry concerns Flyto2 Core, an automation/AI-agent workflow kernel. Before version 2.26.7, multiple HTTP-emitting modules (including http/requests.py, core.api.http_get, core.api.http_post, graphql.query/mutation, monitor.http_check, communication.slack_send, notification.disco...

CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/thirdparty/developer/http/requests.py, core.api.httpget, core.api.httppost, graphql.query, graphql.mutation, monitor.httpcheck, communication.slacksend,...

CVE-2026-18236

creationtimestamp| type| source ---|---|--- 2026-07-29 18:46:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrslj4mpd52z 2026-08-01 12:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrzjagb67l2l...

CVE-2026-67426 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...