CVE-2026-56310

Cap-go before 12.128.2 contains an authorization bypass vulnerability in the GET /organization/members endpoint that allows org-limited API keys to bypass limitedtoorgs restrictions. Attackers with org-limited API keys can read membership data including uid, email, imageurl, role, and istmp from...

CVE-2026-10091

creationtimestamp| type| source ---|---|--- 2026-06-24 11:49:49+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3moztwkagnv2e 2026-06-26 09:15:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp6m7sf5l52m...

CVE-2026-13150

Server-Side Request Forgery SSRF CWE-918 in the PDF generation endpoint GET /api/reports/id/pdf backend/main.py in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the...

CVE-2026-52942

creationtimestamp| type| source ---|---|--- 2026-06-24 10:59:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mozr4oruxj2k 2026-07-01 02:47:26+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0812 2026-07-06 06:54:14+00:00| seen|...

CVE-2026-13150 SSRF in Pentestify PDF generation endpoint via Host header

Server-Side Request Forgery SSRF CWE-918 in the PDF generation endpoint GET /api/reports/id/pdf backend/main.py in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the...

CVE-2026-13150

Server-Side Request Forgery SSRF CWE-918 in the PDF generation endpoint GET /api/reports/id/pdf backend/main.py in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the...

CVE-2026-52938

creationtimestamp| type| source ---|---|--- 2026-06-24 10:40:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mozq25cdjg2m 2026-06-27 16:43:58+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpbvrbz4jf2b...

CVE-2026-52928

creationtimestamp| type| source ---|---|--- 2026-06-24 10:22:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mozozpza2w2f 2026-07-05 03:18:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpumid3pkb2c 2026-07-09 14:30:07+00:00| seen|...

CVE-2026-9612

creationtimestamp| type| source ---|---|--- 2026-06-24 10:16:22+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mozopgf35k23...

CVE-2026-52932

creationtimestamp| type| source ---|---|--- 2026-06-24 10:07:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mozo6s6jhj2y...

CVE-2026-52934

creationtimestamp| type| source ---|---|--- 2026-06-24 09:55:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moznkg7gwb2g 2026-07-01 02:47:21+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0812 2026-07-06 06:24:51+00:00| seen|...

CURL-CVE-2026-12064 proto-default skips SSH verification

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

proto-default skips SSH verification

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

CVE-2026-12095

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'apiurl' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be...

CVE-2026-12100

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be use...

GHSA-52FW-7FW2-FMV5

creationtimestamp| type| source ---|---|--- 2026-06-24 05:42:05+00:00| seen| https://gist.github.com/alon710/0deb8ac6eb09e699071fdbd4071e986c...

CVE-2026-12095

The CVE-2026-12095 entry concerns the WordPress plugin Kargo Takip (versions up to 1.2). It describes an unauthenticated Server-Side Request Forgery (SSRF) via the api_url parameter, enabling an attacker to cause the application to make web requests to arbitrary locations from within the web app....

EUVD-2026-38670

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'apiurl' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be...

CVE-2026-12100

CVE-2026-12100 affects the WordPress URL Preview plugin. It is vulnerable to unauthenticated Server-Side Request Forgery via the url parameter in all versions up to and including 1.0. An unauthenticated attacker can cause the web application to issue requests to arbitrary locations from the web a...

EUVD-2026-38656

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be use...