PT-2026-61213

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An integer underflow exists in the WebUSB GET URL handler within the composite setup function. When the host-supplied wLength is smaller than the WEBUSB URL DESCRIPTOR HEADER LENGTH, an...

CVE-2026-16155

creationtimestamp| type| source ---|---|--- 2026-07-18 23:49:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqxhcsx4ri2x...

CVE-2026-16194

CVE-2026-16194 affects zhayujie CowAgent (up to 2.1.1). The issue is in WebFetch.execute (agent/tools/web_fetch/web_fetch.py): manipulating the url parameter can trigger a server-side request forgery. The attack is described as remote; a fix is available in version 2.1.2 (commit ea47f3097eed4f829...

CVE-2026-16131

creationtimestamp| type| source ---|---|--- 2026-07-18 20:24:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqx3vno4vo23...

CVE-2026-16130

creationtimestamp| type| source ---|---|--- 2026-07-18 20:04:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqx2rtevd62e...

CVE-2026-62857

creationtimestamp| type| source ---|---|--- 2026-07-18 17:38:21+00:00| seen| https://bsky.app/profile/hollo.hollo.social.ap.brid.gy/post/3mqwslocjbbu2 2026-07-19 04:53:12+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mqxycl25wi2d...

CVE-2026-16125

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely...

CVE-2025-71393

creationtimestamp| type| source ---|---|--- 2026-07-18 16:00:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwn4fqmqk2a...

EUVD-2026-45388

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

CVE-2026-16127

The CVE-2026-16127 entry describes a vulnerability in zevorn rt-claw (up to version 0.2.0) affecting the http_request component, specifically claw_net_get and claw_net_post in claw/tools/tool_net.c. The issue arises from manipulation of the url argument, enabling server-side request forgery (SSRF...

CVE-2026-16127 zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...

CVE-2025-71396

creationtimestamp| type| source ---|---|--- 2026-07-18 15:57:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqwmyb5u6r2a...

CVE-2026-16125 zevorn rt-claw http_request net.c claw_net_post server-side request forgery

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function clawnetget/clawnetpost of the file claw/services/tools/net.c of the component httprequest. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely...

EUVD-2026-45379

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16158

CVE-2026-16158 affects @fastify/reply-from. The vulnerability stems from how the internal URL cache key is built by concatenating the destination and source paths without a delimiter in versions 8.3.1 up to (but not including) 12.6.4. This can cause key collisions where different upstreams resolv...

CVE-2026-44203

creationtimestamp| type| source ---|---|--- 2026-07-18 00:31:11+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mquz72wk7c2s...

CVE-2026-56741

creationtimestamp| type| source ---|---|--- 2026-07-18 00:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquyl3hgcb2a 2026-07-18 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvibaehij2c 2026-07-20 22:37:21+00:00| published-proof-of-concept|...