CVE-2026-3471

Mattermost Desktop App shows a vulnerability in versions ≤6.1, 6.0.1, 5.4.13.0 where it does not sanitize an invalid URL in a pop‑up window, enabling a malicious server to repeatedly crash the application via window.open('javascript:alert()'). Root cause: improper handling of URLs in pop‑ups. Imp...

CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-3471 Opening a window with {{javascript:alert()}} as URL causes crash in the Mattermost Desktop App

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-3471

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-6340

creationtimestamp| type| source ---|---|--- 2026-05-18 08:32:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hmztahz2c...

CVE-2026-8788

creationtimestamp| type| source ---|---|--- 2026-05-18 07:23:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mm4drwo3u62g 2026-05-18 08:28:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hfltxds2i...

CVE-2026-8785

creationtimestamp| type| source ---|---|--- 2026-05-18 06:37:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4b7i5vqd2h 2026-05-18 06:52:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mm4c3nhqcd2w...

CVE-2026-8781

creationtimestamp| type| source ---|---|--- 2026-05-18 06:32:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4awjn5ds2h...

CVE-2026-8783

creationtimestamp| type| source ---|---|--- 2026-05-18 06:22:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4aemodku2k...

CVE-2026-8780

creationtimestamp| type| source ---|---|--- 2026-05-18 06:12:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm47spmjgs2p...

CVE-2026-8782

creationtimestamp| type| source ---|---|--- 2026-05-18 06:08:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm47kzzxps2c...

CVE-2026-42658

creationtimestamp| type| source ---|---|--- 2026-05-18 05:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm45mtbgnj2s...

CVE-2026-8779

creationtimestamp| type| source ---|---|--- 2026-05-18 03:21:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3wc4icy32v...

CVE-2026-8777

creationtimestamp| type| source ---|---|--- 2026-05-18 03:16:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3vz5zlvx2p...

CVE-2026-8774

creationtimestamp| type| source ---|---|--- 2026-05-18 02:52:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3unooxqv2p...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the order of operations in the validateDownloadUrl implementation in download-blob.ts and download.ts. The fetch operation called before applying validateDownloadUrl follows redirects by default...

Server-side Request Forgery (SSRF)

Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the order of operations in the validateDownloadUrl implementation in download-blob.ts and download.ts. The fetch operation...

EUVD-2026-30713

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2025-65954: URL Redirection to Untrusted Site

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either depending on configuration redirects the...

PT-2026-41691

Name of the Vulnerable Software and Affected Versions mcp-security versions prior to 0.1.9 Description The mcp-security framework fails to implement mandatory Server-Side Request Forgery SSRF mitigations—a flaw where an attacker can induce the server to make requests to an unintended location—as...