112399 matches found
CVE-2026-57674
creationtimestamp| type| source ---|---|--- 2026-07-03 00:33:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppccmtr7a2i 2026-07-31 05:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrwaqp4st42q...
CVE-2026-58467
creationtimestamp| type| source ---|---|--- 2026-07-03 00:03:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mppaogi76s2i 2026-07-03 15:09:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqtbel3yw2j...
PT-2026-55493
Name of the Vulnerable Software and Affected Versions WP Import Export Lite versions prior to 3.9.31 Description An issue exists in the wpie import upload file from url AJAX action. The plugin initially uses wp safe remote get to download files, which blocks private IP ranges. However, if this ca...
CVE-2026-59094
creationtimestamp| type| source ---|---|--- 2026-07-02 23:39:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpp7cwzdsd2s 2026-07-03 15:10:12+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqtd5su7o2j...
CVE-2026-8482
creationtimestamp| type| source ---|---|--- 2026-07-02 22:23:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp33iarsq22 2026-07-03 03:25:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpplws66tk2q...
Server-side Request Forgery (SSRF)
Overview @lobehub/lobehub is a LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application. Affected versions of this package are...
CVE-2026-12122
creationtimestamp| type| source ---|---|--- 2026-07-02 22:16:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp2oz6fe227...
CVE-2026-57623
creationtimestamp| type| source ---|---|--- 2026-07-02 21:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpoyg7qwqu2c 2026-07-31 09:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrwo5t2kbf2w...
CVE-2026-59095
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...
CVE-2026-58578
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...
CVE-2026-7311
creationtimestamp| type| source ---|---|--- 2026-07-02 20:16:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpotyblujl2q 2026-07-02 22:03:09+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpozwmi2ca2g 2026-07-03 12:16:06+00:00| seen|...
@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
Summary UForm and UAuthForm render a server-side element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler autofill plus Enter on a slow network, JS bundle blocked...
CVE-2026-58465
creationtimestamp| type| source ---|---|--- 2026-07-02 19:50:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mposkbdi6n2z 2026-07-02 22:01:24+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpoztjb2lr27 2026-07-03 12:15:44+00:00| seen|...
CVE-2026-59095
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...
CVE-2026-59095
CVE-2026-59095 affects LobeChat prior to 2.2.10-canary.18. It is a server-side request forgery (SSRF) vulnerability where authenticated attackers can supply input to the skill import service (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints that use the global fetch without the...
EUVD-2026-41426
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...
CVE-2026-59095 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...
CVE-2026-58578
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...
Security Bulletin: SSRF Protection Configuration Vulnerability
Summary A configuration vulnerability was identified where SSRF Server-Side Request Forgery protection could be disabled through default settings, potentially allowing authenticated users to make the server fetch arbitrary URLs including cloud metadata endpoints 169.254.169.254, internal services...
GHSA-8882-FRVV-92W4 @asymmetric-effort/specifyjs: URL parse failure silently allows request
Finding Location: core/src/shared/secure-fetch.ts:42-45 When new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Status Fixed in v0.2.136 — The catch block now throws an error instead of silently...