CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact fast-uri v4.1.0 and earlier do not treat a literal backslash U+005C as an authority delimiter. Node's native WHATWG URL used by fetch, undici, and Node's http/https clients normalizes \ to / for special schemes http, https, ws, wss, ftp, file, so the two parsers extract different hosts fro...

GHSA-V2HH-GCRM-F6HX fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact fast-uri v4.1.0 and earlier do not treat a literal backslash U+005C as an authority delimiter. Node's native WHATWG URL used by fetch, undici, and Node's http/https clients normalizes \ to / for special schemes http, https, ws, wss, ftp, file, so the two parsers extract different hosts fro...

CVE-2026-46989

creationtimestamp| type| source ---|---|--- 2026-07-21 22:06:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sxgxqu62j 2026-07-23 16:45:33+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 15:07:07+00:00| seen|...

CVE-2026-46983

creationtimestamp| type| source ---|---|--- 2026-07-21 22:06:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sxf46fe2e 2026-07-23 16:45:24+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46876

creationtimestamp| type| source ---|---|--- 2026-07-21 22:02:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sqbmfcn2v 2026-07-23 16:45:05+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 10:07:07+00:00| seen|...

CVE-2026-35290

creationtimestamp| type| source ---|---|--- 2026-07-21 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sq7map423 2026-07-23 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 09:37:06+00:00| seen|...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-8986

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-56654

creationtimestamp| type| source ---|---|--- 2026-07-21 21:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ppnqxbj2r 2026-07-21 22:36:25+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-683j-3ff6-hh2x...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

GHSA-5GGR-2F2H-JMVM Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the restore-repo when parsing the pullrequest.yml file. An attacker can cause the server to initiate network requests to arbitrary URLs or disclose local git repositories by supplying a crafted...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764

LMDeploy prior to 0.14.0 contains a server-side request forgery (SSRF) in the _load_http_url function of the media handler. The private-IP guard validates only the original URL; after HTTP redirects, hosts are not re-validated. An unauthenticated attacker can submit a crafted image_url to the cha...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

GHSA-X77V-Q46J-393G Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Summary When oauth2client UPDATEAVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim. The affected code path calls http.Geturl without...

Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Summary When oauth2client UPDATEAVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim. The affected code path calls http.Geturl without...

CVE-2016-20096

creationtimestamp| type| source ---|---|--- 2026-07-21 19:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6lov4zwt2a 2026-07-21 23:16:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6wuxjfgp23...