CVE-2026-42141 Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

CVE-2026-42141 Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.1, an authenticated Server-Side Request Forgery SSRF vulnerability in the Xibo CMS allows users with Library upload permissions to make arbitrary HTTP requests fr...

CVE-2026-43993

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1...

CVE-2026-40638

creationtimestamp| type| source ---|---|--- 2026-05-12 15:39:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlo4ohqfcm2k...

CVE-2026-30905

creationtimestamp| type| source ---|---|--- 2026-05-12 15:28:54+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mlo44fuhc423...

CVE-2026-35071

creationtimestamp| type| source ---|---|--- 2026-05-12 15:20:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlo3nmgh462n...

CVE-2026-30635

Command injection vulnerability in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via the viewtask aka view in the readTranscriptFromCommit function in dist/mcp/server.js when a user reads from an external FORGEBASEURL...

CVE-2026-45284

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:31+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45157

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45159

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45155

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45154

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-42260 Open-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF wit...

CVE-2026-42742

creationtimestamp| type| source ---|---|--- 2026-05-12 11:55:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnq7hqbk62k...

CVE-2026-7562

creationtimestamp| type| source ---|---|--- 2026-05-12 10:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlnllre5gp2c...

CVE-2026-7561

creationtimestamp| type| source ---|---|--- 2026-05-12 09:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlniahwve42x...

CVE-2026-38568

creationtimestamp| type| source ---|---|--- 2026-05-12 09:25:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnhrjjywa2e...

CVE-2026-1681

creationtimestamp| type| source ---|---|--- 2026-05-12 09:09:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlngwl2gxq2o...

CVE-2026-44694

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client N8NAPIURL, a...

CVE-2026-7626 Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields

The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsbhandleslekpaymentredirect function placing the merchant's slekkey and sleksecret API credentials directly into a client-side HTML form, and additionally embedding the...