2310 matches found
CVE-2026-5590
creationtimestamp| type| source ---|---|--- 2026-04-05 04:09:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mipuw2fmfb2d...
org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve
A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...
org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation
An improper input neutralization flaw has been discovered in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a...
CVE-2026-34766
creationtimestamp| type| source ---|---|--- 2026-04-04 05:50:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mink4dc63b2i...
CVE-2026-34954
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.downloadfile in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream with followredirects=True. An attacker who controls the URL can reach any...
CVE-2025-59710
creationtimestamp| type| source ---|---|--- 2026-04-03 16:55:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mim6rab3eg2d...
CVE-2026-5470
A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...
CVE-2026-5470 mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery
A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...
CVE-2026-34785
A flaw was found in Rack. The Rack::Static component, which serves static files for web applications, uses a simple string prefix check to determine if a request should be served as a static file. This can lead to unintended information disclosure, as files with names that merely share a configur...
PT-2026-30190
Name of the Vulnerable Software and Affected Versions imich versions prior to 2.6.0 Description Prior to version 2.6.0, the Immich application discloses credentials when a user authenticates to a shared album. The application transmits the album password within the URL query parameters in a GET...
immich 安全漏洞
Immich is a high-performance, open-source self-hosted photo and video management solution developed by Immich. Versions of Immich prior to 2.6.0 contained security vulnerabilities. These vulnerabilities stemmed from the transmission of passwords during the shared album authentication process via...
PraisonAI 代码问题漏洞
PraisonAI is a low-code multi-intelligent body collaboration framework. PraisonAI suffers from a code issue vulnerability that stems from the FileTools.downloadfile function validating the target path but not validating the url parameter, which can be exploited by an attacker to cause the attacke...
CVE-2026-5322
creationtimestamp| type| source ---|---|--- 2026-04-02 06:16:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miiklklffm25 2026-04-02 07:15:36+00:00| seen| Telegram/W6jOpjyTj769pCXa-ZRWw2obquTHPJnxlg6AY1uAebMFs...
PT-2026-29741
Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched. In Szafir SDK Web it is possible to change the URL HTTP Origin of the application call location. An unauthenticated attacker can craft a website that is able to launch...
Server-side Request Forgery (SSRF)
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the downloadfile function when the url parameter is not validated before being passed to the HTTP...
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin
Summary The TopMenu plugin renders menu item fields icon classes, URLs, and text labels directly into HTML without applying htmlspecialchars or any other output encoding. Since menu items are rendered on every public page through plugin hooks, a single malicious menu entry results in stored...
CVE-2026-34551
creationtimestamp| type| source ---|---|--- 2026-04-01 02:02:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miflwvexr32g...
CVE-2026-34448 SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop client
SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From - Asset Field” enabled. The vulnerable code accepts arbitrary...
