CVE-2026-41905 FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl in app/Misc/Helper.php follows HTTP redirects via curlGetLastRedirectedUrl but then re-validates the original URL instead of the final redirect destination. An...

CVE-2026-41687

creationtimestamp| type| source ---|---|--- 2026-05-07 18:02:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbsf3j6jh2p...

CVE-2026-8081

CVE-2026-8081 affects router-for-me CLIProxyAPI 6.9.29. The vulnerability is a server-side request forgery in the API Tools handler (internal/api/handlers/management/api_tools.go) caused by manipulating the url argument. This enables remote exploitation as disclosed publicly. Remediation details ...

CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery

A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...

CLSA-2026-1778175425 curl: Fix of 2 CVEs

CVE-2016-8624: invalid URL parsing with '' - CVE-2016-8623: use-after-free via shared cookies...

GHSA-GR3R-CRP5-QRRM

creationtimestamp| type| source ---|---|--- 2026-05-07 17:10:29+00:00| seen| https://gist.github.com/alon710/56ddf2e902ba484e9ffc934e550f18ab...

Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for...

GHSA-J944-W549-3453 Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker

Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for...

CVE-2026-5385

creationtimestamp| type| source ---|---|--- 2026-05-07 16:00:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlblk4t3e52k 2026-06-02 13:45:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mncq4nolce2y 2026-06-02 20:51:19+00:00| seen|...

CVE-2026-42321

creationtimestamp| type| source ---|---|--- 2026-05-07 16:00:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlblk4t3e52k 2026-06-02 13:45:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mncq4nolce2y...

EUVD-2025-209725

Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting xss vulnerability via crafted URL being rended from cron.erb...

Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting xss vulnerability via crafted URL being rended from cron.erb...

GHSA-XV9C-MJW8-79GF Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting xss vulnerability via crafted URL being rended from cron.erb...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering process in cron.erb. An attacker can execute arbitrary JavaScript in the context of the user's browser by supplying a crafted URL. Details Cross-site scripting or XSS is a code vulnerability th...

PYSEC-2026-2317

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

CVE-2026-20168

creationtimestamp| type| source ---|---|--- 2026-05-07 14:40:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlbh2zrqup2k...

CVE-2026-33589

creationtimestamp| type| source ---|---|--- 2026-05-07 14:37:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbgwnlpar2h 2026-05-22 13:33:17+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mmh2d5wycd2b...

CVE-2026-30816

creationtimestamp| type| source ---|---|--- 2026-05-07 14:30:07+00:00| seen| https://infosec.place/objects/7874175f-aefb-4114-8cfb-e9c289bbee70...

CVE-2026-41643

creationtimestamp| type| source ---|---|--- 2026-05-07 14:06:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbf64y5jg2p 2026-05-07 21:06:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc4olm2532w...