CVE-2026-45155

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45154

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-42260 Open-WebSearch: SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF wit...

CVE-2026-42742

creationtimestamp| type| source ---|---|--- 2026-05-12 11:55:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnq7hqbk62k...

CVE-2026-7562

creationtimestamp| type| source ---|---|--- 2026-05-12 10:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlnllre5gp2c...

CVE-2026-7561

creationtimestamp| type| source ---|---|--- 2026-05-12 09:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlniahwve42x...

CVE-2026-38568

creationtimestamp| type| source ---|---|--- 2026-05-12 09:25:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnhrjjywa2e...

CVE-2026-1681

creationtimestamp| type| source ---|---|--- 2026-05-12 09:09:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlngwl2gxq2o...

CVE-2026-44694

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an authenticated server-side request forgery vulnerability affecting the webhook trigger tools, the n8n API client N8NAPIURL, a...

CVE-2026-7626 Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields

The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsbhandleslekpaymentredirect function placing the merchant's slekkey and sleksecret API credentials directly into a client-side HTML form, and additionally embedding the...

Malicious code in @chahuadev/junk-sweeper-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d446150767f92344d8d0a699f5879bd746200fb8beb60554408699868f03d51 The package's postinstall script package.json line 10: "postinstall": "node install.js" unconditionally fetches a platform-native executable from...

Malicious code in dcchbot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df79831d1b486c8ca704295b410cec7b66be85aa87c3244d97ff1e87f643183a The package performs multiple installer-hostile behaviors. 1 dcchbot/init.py auto-invokes run on import, which triggers interactive input prompts and...

CVE-2026-40133

creationtimestamp| type| source ---|---|--- 2026-05-12 05:12:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmzol4bqz2i 2026-05-12 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnybnopq22h 2026-05-12 14:25:07+00:00| seen|...

CVE-2026-40136

creationtimestamp| type| source ---|---|--- 2026-05-12 04:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmyt54c6l2p 2026-05-12 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnybnopq22h 2026-05-12 14:25:07+00:00| seen|...

CVE-2026-34260

creationtimestamp| type| source ---|---|--- 2026-05-12 04:56:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlmyrdie2u2r 2026-05-12 14:20:28+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnybnopq22h 2026-05-12 14:25:06+00:00| seen|...

Exploit for Server-Side Request Forgery in Rbaskets Request_Baskets

CVE-2023-27163 — request-baskets SSRF Exploit I wrote this ex...

EUVD-2026-29370

Due to a reflected cross-site scripting XSS vulnerability in SAP NetWeaver Application Server ABAP Applications based on Business Server Pages, an unauthenticated attacker could craft a URL that exploits an unprotected URL parameter to embed a malicious script. If a victim clicks the link, the...

CVE-2026-27682

Due to a reflected cross-site scripting XSS vulnerability in SAP NetWeaver Application Server ABAP Applications based on Business Server Pages, an unauthenticated attacker could craft a URL that exploits an unprotected URL parameter to embed a malicious script. If a victim clicks the link, the...

CVE-2026-34258 Content Spoofing vulnerability in SAPUI5 (Search UI)

SAPUI5 Search UI allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low...

CVE-2026-34258

SAPUI5 (Search UI) is affected by CVE-2026-34258. An unauthenticated attacker can manipulate specific URL parameters in the Search UI to deliver attacker-controlled content, potentially misleading users into clicking on pages rendered by the application. Impact is confined to confidentiality (low...