CVE-2026-42658

creationtimestamp| type| source ---|---|--- 2026-05-18 05:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm45mtbgnj2s...

CVE-2026-8779

creationtimestamp| type| source ---|---|--- 2026-05-18 03:21:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3wc4icy32v...

CVE-2026-8777

creationtimestamp| type| source ---|---|--- 2026-05-18 03:16:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3vz5zlvx2p...

CVE-2026-8774

creationtimestamp| type| source ---|---|--- 2026-05-18 02:52:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3unooxqv2p...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the order of operations in the validateDownloadUrl implementation in download-blob.ts and download.ts. The fetch operation called before applying validateDownloadUrl follows redirects by default...

Server-side Request Forgery (SSRF)

Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the order of operations in the validateDownloadUrl implementation in download-blob.ts and download.ts. The fetch operation...

EUVD-2026-30713

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

PT-2026-41708

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting XSS in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax...

PT-2026-41691

Name of the Vulnerable Software and Affected Versions mcp-security versions prior to 0.1.9 Description The mcp-security framework fails to implement mandatory Server-Side Request Forgery SSRF mitigations—a flaw where an attacker can induce the server to make requests to an unintended location—as...

HSC MailInspector 跨站脚本漏洞

HSC MailInspector is a mail security analysis and filtering system developed by the Brazilian company HSC. Version 5.3.3-7 of HSC MailInspector contains a cross-site scripting vulnerability. This vulnerability arises from the use of alternative or obfuscated JavaScript syntax in user inputs withi...

PT-2026-41695

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.22 Statamic versions prior to 6.18.1 Description The Glide image proxy contains a flaw where URL validation can be bypassed using an IP representation that is not normalized before the public-IP check. This allo...

CVE-2026-8768 vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8768 vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8721

creationtimestamp| type| source ---|---|--- 2026-05-17 20:22:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mm36uqfydx2b 2026-05-17 22:32:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3g4qzayl2p 2026-05-30 11:00:53+00:00| seen|...

CVE-2026-8759

creationtimestamp| type| source ---|---|--- 2026-05-17 18:32:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2ypb5hlu2t...

CVE-2025-15024

creationtimestamp| type| source ---|---|--- 2026-05-17 15:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mm2mvccr7h2t...

CVE-2018-25327

creationtimestamp| type| source ---|---|--- 2026-05-17 14:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2mhklkqp2p...

CVE-2018-25329

creationtimestamp| type| source ---|---|--- 2026-05-17 14:45:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2m222nlt2h...

CVE-2018-25331

creationtimestamp| type| source ---|---|--- 2026-05-17 14:36:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2lj3hrou2o...

CVE-2018-25329

WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting file paths into the url parameter. Attackers can send GET requests to wp.spritz.content.filter.php with malicious url values to access...