CVE-2026-42432

creationtimestamp| type| source ---|---|--- 2026-04-28 21:10:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mklio626qh2i...

Security Bulletin: Server-Side Request Forgery (SSRF) in Langflow URL Component

Summary IBM Langflow Desktop contains a Server-Side Request Forgery SSRF vulnerability in the URL data source component where user-supplied URLs are insufficiently validated before being used in backend HTTP requests, allowing authenticated attackers to force the Langflow server to make arbitrary...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-7354

creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 00:20:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkltd2klvx2p 2026-05-03 18:00:00+00:00| seen|...

CVE-2026-7346

creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 00:33:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkltzjp3az2h 2026-05-03 18:00:00+00:00| seen|...

CVE-2026-7352

creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 00:22:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkltfqpevd2i 2026-05-10 11:02:09+00:00| seen|...

CVE-2026-7291

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-41391 OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling

OpenClaw before 2026.3.31 fails to properly sanitize PIPINDEXURL and UVINDEXURL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting...

CVE-2026-41391

OpenClaw before 2026.3.31 fails to properly sanitize PIPINDEXURL and UVINDEXURL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting...

EUVD-2026-26080

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful...

CVE-2026-7291

Technical details (affected products, versions, root cause, impact, and remediation) are not publicly available in the provided documents; monitor for updates.

EUVD-2026-26074

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-7291 o2oa URL Fetching FileAction.java FileAction server-side request forgery

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-7291 o2oa URL Fetching FileAction.java FileAction server-side request forgery

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-24186

creationtimestamp| type| source ---|---|--- 2026-04-28 16:53:26+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116483372219679349 2026-04-28 21:54:31+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkll5e32xe2a 2026-05-25 20:37:06+00:00| seen|...

CVE-2026-7288

creationtimestamp| type| source ---|---|--- 2026-04-28 16:47:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkzyjfb672r 2026-04-28 16:56:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkl2irbp352e 2026-05-28 10:07:15+00:00| seen|...

CVE-2026-27760

creationtimestamp| type| source ---|---|--- 2026-04-28 16:34:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkzbukgyd2p 2026-06-17 09:12:42+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-27760.yaml 2026-09-08...

Important: Red Hat Security Advisory: yggdrasil security update

An update for yggdrasil is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2026-7288

A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability affects the function sub4151FC of the file /boafrm/formVpnConfigSetup. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed t...

CVE-2026-7289

A vulnerability was found in D-Link DIR-825M 1.1.12. This issue affects the function sub414BA8 of the file /boafrm/formWanConfigSetup. The manipulation of the argument submit-url results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used...