117341 matches found
CVE-2026-35579
creationtimestamp| type| source ---|---|--- 2026-05-06 02:01:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5m7sjb5n2e...
CVE-2026-39849
creationtimestamp| type| source ---|---|--- 2026-05-06 01:56:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5lwszndj2k...
CVE-2026-39383
creationtimestamp| type| source ---|---|--- 2026-05-06 01:46:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5leuajap2k...
CVE-2026-4060
creationtimestamp| type| source ---|---|--- 2026-05-06 01:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml5kmmtzgy2s 2026-05-14 07:00:14+00:00| seen| Telegram/1SOBBgvcIqPC2HdBO73HfJmtzy7hfeZMdIE0nBIzwgN91l0 2026-09-12 10:00:20+00:00| seen|...
CVE-2026-40110
creationtimestamp| type| source ---|---|--- 2026-05-06 01:30:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml5khgwkuj2e...
CVE-2026-35253: URL Redirection to Untrusted Site
Vulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versions that is affected is v0.22.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Macaron Tool. Successful attacks of this...
WordPress plugin LatePoint 跨站脚本漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
PT-2026-37351
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking form page url' parameter in all versions up to, and including, 5.5.0 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-38265
Name of the Vulnerable Software and Affected Versions New API versions 0.11.9-alpha.1 and earlier Description New API, a large language model LLM gateway and artificial intelligence AI asset management system, contains a Server-Side Request Forgery SSRF flaw. This issue occurs due to insufficient...
PT-2026-38255
Name of the Vulnerable Software and Affected Versions Slider Revolution versions 7.0.0 through 7.0.10 Description Insufficient file type validation in the get media url and check file path functions allows authenticated attackers with subscriber-level access or higher to perform an Arbitrary File...
AlmaLinux 10 : image-builder (ALSA-2026:3840)
The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:3840 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 golang: net/url: Memory exhaustion in...
PT-2026-38305
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.32 Description A logical flaw in the URL checking logic allows attackers to bypass security filters, leading to Server-Side Request Forgery SSRF. The system uses the validate url function to perform security...
CVE-2026-44117: Server-Side Request Forgery (SSRF)
OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSRF protections by sending crafted image URLs to uploadC2CMedia and uploadGroupMedia endpoints to relay unintended requests...
CVE-2026-4061
creationtimestamp| type| source ---|---|--- 2026-05-05 23:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml5dw2bfnu2a 2026-09-12 10:00:20+00:00| seen| https://t.me/shimiscyberworld/1114 2026-09-13 00:00:05+00:00| seen| https://t.me/shimiscyberworld/1114...
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
Summary Two endpoints in AVideo call isSSRFSafeURL to validate user-supplied URLs, then fetch them using bare filegetcontents without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an...
CVE-2026-7857
creationtimestamp| type| source ---|---|--- 2026-05-05 22:01:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml56snv3fo2h...
Server-side Request Forgery (SSRF)
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the afterDonation process due to insufficient validation of user-supplied webhook URLs and improper handling of HTTP redirects...
GHSA-WP38-WHX3-XFFH AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
Summary An authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses. When any other user including a second account owned by the same attacker...
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
Summary An authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses. When any other user including a second account owned by the same attacker...