112226 matches found
CVE-2026-13147
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts Server-Side Request Forgery...
CVE-2026-12606
creationtimestamp| type| source ---|---|--- 2026-07-20 05:19:29+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mr2kaioqa522...
PT-2026-61735
Name of the Vulnerable Software and Affected Versions GRAPHIFY versions 0.3.2 through 0.4.29 Description A remote attacker can execute arbitrary code through the validate url, safe fetch, build opener, fetch html, and download binary functions. Recommendations At the moment, there is no informati...
MAL-2026-10943 Malicious code in aftermathfi (npm)
The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...
TencentOS Server 3: container-tools:rhel8 (TSSA-2026:0671)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0671 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
CVE-2026-64167
creationtimestamp| type| source ---|---|--- 2026-07-19 18:10:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzeuwjbfx2g...
CVE-2026-64171
creationtimestamp| type| source ---|---|--- 2026-07-19 18:05:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqzelkqwie23...
CVE-2026-63896
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-63829
creationtimestamp| type| source ---|---|--- 2026-07-19 15:54:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz5abk4l72e 2026-07-20 18:42:43+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr3x4rxuus2j 2026-07-20 18:42:45+00:00| seen|...
CVE-2026-63826
creationtimestamp| type| source ---|---|--- 2026-07-19 15:52:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqz54vtxvy2i...
CVE-2026-16221
Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...
DEBIAN-CVE-2026-16221
Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...
CVE-2026-63896
The CVE-2026-63896 entry documents a Linux kernel flaw in usb: gadget: composite: GET_URL handling for WebUSB, where landing_page_length is miscomputed as an unsigned difference when wLength
CVE-2026-63896
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-63896 usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix integer underflow in WebUSB GETURL handling The WebUSB GETURL handler in compositesetup narrows landingpagelength to fit the host-supplied wLength using landingpagelength = wlength -...
CVE-2026-13765
creationtimestamp| type| source ---|---|--- 2026-07-19 14:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqywv26hkv2o...
CVE-2026-53376
creationtimestamp| type| source ---|---|--- 2026-07-19 12:11:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqyqt2icze23...
OESA-2026-2987 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or...