GHSA-287W-MXQ6-X2CP

creationtimestamp| type| source ---|---|--- 2026-07-06 21:42:10+00:00| seen| https://gist.github.com/alon710/42394c2aa3975303824ce1e33bac787e...

CVE-2026-13698

creationtimestamp| type| source ---|---|--- 2026-07-06 16:15:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyifa6m562w 2026-07-09 16:02:50+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mq7z2rkvbo2o...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

PYSEC-2026-914 Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2025-50493

creationtimestamp| type| source ---|---|--- 2026-07-06 06:10:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpxgkii2s32i...

CVE-2026-14641

creationtimestamp| type| source ---|---|--- 2026-07-05 00:36:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpudh4j6re2d...

GHSA-V8VC-CMF9-GG2C

creationtimestamp| type| source ---|---|--- 2026-07-04 12:51:30+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mpt3zzsn3f2w...

CVE-2026-27779 Gitea forwarded-proto handling allows public URL spoofing

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...

CVE-2026-27779 Gitea forwarded-proto handling allows public URL spoofing

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...

CVE-2026-27779

Gitea versions before 1.25.5 are vulnerable to an Access Control Bypass due to improper validation of the forwarded-proto header. An attacker can inject or manipulate this header to force the application to generate spoofed canonical URLs when detecting public URLs. The underlying issue resides i...

CVE-2026-14620

creationtimestamp| type| source ---|---|--- 2026-07-03 17:04:38+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mpqzpoxq4c2i 2026-07-03 22:00:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mprkb56qhi2z...

CVE-2026-59234

creationtimestamp| type| source ---|---|--- 2026-07-03 14:41:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpqrpeabqu2l 2026-07-04 04:11:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mps6yxxuv723...

EUVD-2026-41531

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the...

CVE-2026-48192

creationtimestamp| type| source ---|---|--- 2026-07-03 10:02:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqc5saxiw2u...

EUVD-2026-41507

When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like https://[email protected]/, curl could wrongly get and use the password for another user set in the .netrc file for that host if such a one exists and there is no...

EUVD-2026-41482

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS...

CVE-2026-12960

An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to send a crafted Intent that causes ASUS Router App to open an specified URL. Refer to the ' Security Update for ASUS Router Android App ' section on the ASUS...

CVE-2026-9145

creationtimestamp| type| source ---|---|--- 2026-07-02 22:18:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp2suimi22o 2026-07-03 03:22:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpplrucijr2n...

CVE-2026-59095 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...

CVE-2026-55111

creationtimestamp| type| source ---|---|--- 2026-07-02 18:25:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mponqlwrdj2m 2026-07-03 07:08:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppyfkkhz32m 2026-07-08 11:01:21+00:00| seen|...