112272 matches found
CVE-2026-58661
creationtimestamp| type| source ---|---|--- 2026-07-10 20:21:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxy5ayys2x 2026-07-13 23:47:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkuvklvvh2c 2026-07-16 08:13:00+00:00| seen|...
CVE-2026-59793
creationtimestamp| type| source ---|---|--- 2026-07-10 20:17:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxrw55ea2i 2026-07-11 00:33:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg2wgqn22i 2026-07-11 04:37:07+00:00| seen|...
CVE-2026-55461
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url-previous from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect-intended... when redirectoption=back is submitted, allowing Snipe-IT to be used a...
CVE-2026-57211
RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...
CVE-2026-57211 RabbitMQ: UNC SSRF affecting the management UI on Windows
RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...
CVE-2026-55461
Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url-previous from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect-intended... when redirectoption=back is submitted, allowing Snipe-IT to be used a...
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL
Summary The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An...
EUVD-2026-39122
SiYuan: Path Traversal via Double URL Encoding in /assets/path publish mode arbitrary file─read, Incomplete fix of CVE-2026-41894...
CVE-2026-15146
GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...
CVE-2026-43752
creationtimestamp| type| source ---|---|--- 2026-07-10 19:04:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqctoyn4qp2f...
CVE-2026-5801
creationtimestamp| type| source ---|---|--- 2026-07-10 18:52:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsycg2de25 2026-07-10 20:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqcwsvtxff2d 2026-07-10 20:41:14+00:00| seen|...
CVE-2026-22660
creationtimestamp| type| source ---|---|--- 2026-07-10 18:48:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcsrjjulo27...
CVE-2026-15299
creationtimestamp| type| source ---|---|--- 2026-07-10 18:47:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcspog65f2c...
CVE-2026-51119
creationtimestamp| type| source ---|---|--- 2026-07-10 18:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsnl6hmo2b 2026-07-10 22:43:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd7wcheku2c 2026-07-11 00:51:44+00:00| seen|...
CVE-2026-51597
creationtimestamp| type| source ---|---|--- 2026-07-10 18:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsjz26m72r 2026-07-11 00:34:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg3vxy2e27...
CVE-2026-57736
creationtimestamp| type| source ---|---|--- 2026-07-10 18:07:16+00:00| seen| https://bsky.app/profile/martechnotes.bsky.social/post/3mqcqi72gkh2b...
CVE-2026-55671
ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...
EUVD-2026-42978
ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...
MAL-2026-10153 Malicious code in notifier-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4c2346bef8105dc24079ee47eb8cd65dbb92f7dbbd6d17ac0c576646878298c The package presents itself as a pino-compatible logger main entry exports a middleware aliased as pino, and lib/ contains pino-shaped files such as...