118824 matches found
CVE-2026-39440
creationtimestamp| type| source ---|---|--- 2026-04-23 15:16:16+00:00| published-proof-of-concept| Telegram/GpzWIna0u4Xk2Mxyx7IImpynDcGXZQ8MHW9U4L55IHFQ 2026-04-23 16:35:18+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mk6gxwkn622a 2026-04-23 19:43:50+00:00| seen|...
python: Python: Command-line option injection in webbrowser.open() via crafted URLs
A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...
CVE-2026-35334
creationtimestamp| type| source ---|---|--- 2026-04-23 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk675r76zg27...
CVE-2025-58226
creationtimestamp| type| source ---|---|--- 2026-04-23 11:38:32+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-58226.yaml 2026-04-25 21:03:13+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkdwukgv3w2f...
python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API
A flaw was found in the Python webbrowser.open API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution...
CVE-2026-3960 Remote Code Execution in h2oai/h2o-3
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific...
CVE-2026-42183
creationtimestamp| type| source ---|---|--- 2026-04-23 08:17:54+00:00| published-proof-of-concept| https://github.com/argoproj/argo-workflows/security/advisories/GHSA-p4gq-3vxj-f4jq 2026-05-09 05:16:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfijpclhw2i...
SUSE CVE-2026-40161
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL...
CVE-2026-4917: Improper Limitation of a Pathname to a Restricted Directory
IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...
PT-2026-34760
Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description An open redirect allows an unauthorized attacker to redirect users to untrusted sites, which can lead to elevation of privilege over a network and risk to user accounts. This...
IBM Guardium Data Protection 路径遍历漏洞
IBM Guardium Data Protection is a data security and compliance monitoring platform for database activity monitoring, vulnerability assessment and sensitive data discovery. A directory traversal vulnerability exists in IBM Guardium Data Protection. The vulnerability stems from a failure to properl...
CVE-2026-31171
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the url parameter to /cgi-bin/cstecgi.cgi...
PT-2026-38565
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description URLs are not correctly escaped within the content attribute of a tag. If the URL content contains ASCII whitespaces around the = rune, the escaper fails to proce...
CVE-2026-41455
WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation. Attackers who can create or modify integrations can set webhook URLs to internal network...
CVE-2026-41170
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the RestoreController.PostRestoreJob endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient...
EUVD-2026-25106
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as ...
CVE-2026-41170 Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests
Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the RestoreController.PostRestoreJob endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient...
CVE-2026-41455
CVE-2026-41455 affects WeKan
CVE-2019-25714
creationtimestamp| type| source ---|---|--- 2026-04-22 21:02:30+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk4fgsrcnp2x...
CVE-2026-34415
creationtimestamp| type| source ---|---|--- 2026-04-22 20:01:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4bzgzyko2r 2026-04-22 21:21:17+00:00| published-proof-of-concept| Telegram/he0Z1Xxb4PMjQ5eYVBKNYLHtJZg-G0d3XJmG72co7nWMuw 2026-04-23 07:30:28+00:00| seen|...