CVE-2026-2940 Zaher1307 tiny_web_server URL tiny.c out-of-bounds write

A vulnerability was determined in Zaher1307 tinywebserver up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tinywebserver/tiny.c of the file tinywebserver/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. The attack can be initiated remotel...

Tiny Web Server 缓冲区错误漏洞

Tiny Web Server is a web server developed by Ahmed Zaher as an individual project. Tiny Web Server has a buffer overflow vulnerability, which stems from out-of-bounds writes in the URL processor...

PT-2026-21427

Name of the Vulnerable Software and Affected Versions Zaher1307 tiny web server versions prior to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b Description A flaw exists in the URL Handler component of Zaher1307 tiny web server. This issue allows for an out-of-bounds write, potentially enabling remote...

D-Link DWR-M960 安全漏洞

The D-Link DWR-M960 is a router produced by D-Link Corporation. The D-Link DWR-M960 version 1.01.07 has a security vulnerability. This vulnerability stems from the stack buffer overflow issue in the operation of the submit-url parameter in the sub427D74 function found in the /boafrm/formIpQoS fil...

CVE-2019-25349

creationtimestamp| type| source ---|---|--- 2026-02-20 03:40:12+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mfb6qud6tq2u...

CVE-2025-71247

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2025-15562

The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. This allows an attacker to execute arbitrary JavaScript in the victim's browser if the victim opens a URL prepared by the attacker...

WordPress plugin Printful Integration for WooCommerce 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

CVE-2026-1437

Reflected Cross-Site Scripting XSS vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker ...

CVE-2026-1439

CVE-2026-1439 describes a reflected XSS in the Graylog Web Interface console (version 2.2.3). The root cause is lack of proper sanitization and escaping in HTML output, with several endpoints including URL segments directly in responses without output encoding. Practical impact stated across sour...

CVE-2026-2239

creationtimestamp| type| source ---|---|--- 2026-02-18 12:24:36+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mf534lryxrw2 2026-03-01 16:50:30+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mfz747rrfs2s...

GHSA-5XFQ-5MR7-426Q

creationtimestamp| type| source ---|---|--- 2026-02-18 02:10:30+00:00| seen| https://gist.github.com/alon710/d996dd0c6e7f9ea84de3ae6decf3247e...

Graylog Web Interface 安全漏洞

The Graylog Web Interface is a web interface provided by the American company Graylog. Version 2.2.3 of the Graylog Web Interface contains a security vulnerability. This vulnerability arises from improper access control when modifying the user ID in the URL. It may allow authenticated users to...

The vulnerability of the SCADA system FAST/TOOLS lies in the redirection of URLs to an unreliable website, allowing a hacker to redirect users to any given URL address.

The vulnerability of the SCADA system FAST/TOOLS is related to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL address...

CVE-2025-27900

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 is affected by an open redirect vulnerability that could allow a remote attacker to perform phishing by spoofing the URL and redirecting users to a malicious site. Affected component: DB2 Recovery Expert for LUW 5.5 Interim Fix 002. Underlying i...

GO-2026-4474 File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL in github.com/filebrowser/filebrowser

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL in github.com/filebrowser/filebrowser...

PT-2026-8402

SQL injection vulnerability SQLi in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker executes a malicious payload in the URL generated after downloading the student's report card in the ‘Day-to-day’ section from the mobile...

Missing Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Missing Authorization when processing channel mentions. An attacker can access information about the existence of teams and their URL names by...

CVE-2026-2556

A security vulnerability has been detected in cskefu up to 8.0.1. This issue affects some unknown processing of the file com/cskefu/cc/controller/resource/MediaController.java of the component Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack may be...

The vulnerability of the graphical user interface of Fortinet FortiOS operating systems allows a hacker to redirect users to any desired URL address.

The vulnerability of the graphical user interface of Fortinet FortiOS operating systems is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to redirect users to any desired URL address...