CVE-2026-9099

creationtimestamp| type| source ---|---|--- 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:39+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0815 2026-07-02 05:18:11+00:00| seen|...

CVE-2026-6638

creationtimestamp| type| source ---|---|--- 2026-06-29 13:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkznxcc72u 2026-07-01 02:45:31+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0816 2026-08-05 08:45:03+00:00| seen|...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

CVE-2026-13560

A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...

CVE-2026-13554

creationtimestamp| type| source ---|---|--- 2026-06-29 12:06:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgh6k26bc25...

CVE-2026-13552

creationtimestamp| type| source ---|---|--- 2026-06-29 12:05:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgh5oi7yr2n...

PYSEC-2026-339 FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...

PYSEC-2026-495 pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)

Summary The fix for CVE-2026-33992 GHSA-m74m-f7cr-432x added IP validation to BaseDownloader.download that checks the hostname of the initial download URL. However, pycurl is configured with FOLLOWLOCATION=1 and MAXREDIRS=10, causing it to automatically follow HTTP redirects. Redirect targets are...

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

Technical DescriptionThe OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service.A critical vulnerability exists in the buildurl method. When an OpenAPI...

PYSEC-2026-497 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

PYSEC-2026-338 FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

Technical Description The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A critical vulnerability exists in the buildurl method. When an OpenAPI...

CVE-2026-13560

Summary : CVE-2026-13560 affects Edimax EW-7478APC (firmware 1.04). The vulnerable component is the POST Request Handler’s /goform/formAccept function, where manipulating the argument submit-url enables an OS command injection . The attack is remote and the exploit has been disclosed publicly. Th...

CVE-2026-13560 Edimax EW-7478APC POST Request formAccept os command injection

A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...

CVE-2026-13560 Edimax EW-7478APC POST Request formAccept os command injection

A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...

MAL-2026-6592 Malicious code in maplibre-gl-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815 The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects...

CVE-2026-13537

creationtimestamp| type| source ---|---|--- 2026-06-29 08:09:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfzx2zswj2a 2026-06-29 10:48:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgctwjk7522 2026-06-29 13:09:08+00:00| seen|...

CVE-2017-0003

creationtimestamp| type| source ---|---|--- 2026-06-29 07:54:37+00:00| seen| https://gist.github.com/tu-trinh-scale/cb28617ddc3f6adf2b7f5da89706e0f7 2026-07-26 07:02:13+00:00| seen| https://t.me/KaitNews/2468 2026-07-27 00:01:51+00:00| seen| https://t.me/KaitNews/2468 2026-08-05 20:00:04+00:00|...

CVE-2026-54815

creationtimestamp| type| source ---|---|--- 2026-06-29 07:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpfwxrmzjl2i...

CVE-2026-13543

A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Login. The manipulation results in improper authentication. It is possible to...

BIT-GITLAB-2026-12635 Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through...