HSC MailInspector 跨站脚本漏洞

HSC MailInspector is a mail security analysis and filtering system developed by the Brazilian company HSC. Version 5.3.3-7 of HSC MailInspector contains a cross-site scripting vulnerability. This vulnerability arises from the use of alternative or obfuscated JavaScript syntax in user inputs withi...

PT-2026-41708

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting XSS in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax...

PT-2026-41695

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.22 Statamic versions prior to 6.18.1 Description The Glide image proxy contains a flaw where URL validation can be bypassed using an IP representation that is not normalized before the public-IP check. This allo...

CVE-2026-3471: Improper Authorization in Handler for Custom URL Scheme

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

CVE-2026-8768 vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8768 vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8721

creationtimestamp| type| source ---|---|--- 2026-05-17 20:22:45+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mm36uqfydx2b 2026-05-17 22:32:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm3g4qzayl2p 2026-05-30 11:00:53+00:00| seen|...

CVE-2026-8759

creationtimestamp| type| source ---|---|--- 2026-05-17 18:32:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2ypb5hlu2t...

CVE-2025-15024

creationtimestamp| type| source ---|---|--- 2026-05-17 15:00:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mm2mvccr7h2t...

CVE-2018-25327

creationtimestamp| type| source ---|---|--- 2026-05-17 14:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2mhklkqp2p...

CVE-2018-25329

creationtimestamp| type| source ---|---|--- 2026-05-17 14:45:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2m222nlt2h...

CVE-2018-25331

creationtimestamp| type| source ---|---|--- 2026-05-17 14:36:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2lj3hrou2o...

CVE-2018-25329

WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting file paths into the url parameter. Attackers can send GET requests to wp.spritz.content.filter.php with malicious url values to access...

CVE-2018-25329

WordPress Plugin WP with Spritz 1.0 contains a remote file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting file paths into the url parameter. Attackers can send GET requests to wp.spritz.content.filter.php with malicious url values to access...

CVE-2018-25324

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wpabspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wpabspath values to...

CVE-2018-25324

The CVE-2018-25324 entry concerns the WordPress plugin Simple Fields versions 0.2–0.3.5, which contains a local file inclusion (LFI) flaw via the wp_abspath parameter. Unauthenticated attackers can read arbitrary files (e.g., /etc/passwd) by injecting null bytes into wp_abspath on PHP versions be...

CVE-2026-8739

creationtimestamp| type| source ---|---|--- 2026-05-17 09:02:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlzyqregxy26 2026-05-17 12:22:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2e2tqw5c2p...

CVE-2026-8730

creationtimestamp| type| source ---|---|--- 2026-05-17 08:31:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlzx4wwz7d2c...

CVE-2026-8719

creationtimestamp| type| source ---|---|--- 2026-05-17 04:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlzk2kmiy32i 2026-05-17 17:12:56+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mm2ubcolsp2s 2026-05-18 05:18:36+00:00| seen|...

CVE-2018-25334

creationtimestamp| type| source ---|---|--- 2026-05-17 04:16:45+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2018-25334 2026-05-17 15:17:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2nt77cup2r...