Open Redirect

React Router is vulnerable to Open Redirect. The vulnerability is due to unsafe handling of SPA navigation redirects generated from loaders or actions in certain modes, which allows an attacker to inject untrusted redirect URLs and trigger unintended JavaScript execution on the client...

CVE-2026-22786

creationtimestamp| type| source ---|---|--- 2026-01-11 14:44:05+00:00| published-proof-of-concept| https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-3558-j79f-vvm6 2026-01-12 23:03:01+00:00| published-proof-of-concept| Telegram/r1WVj1DWEYgy6-PsI-eM62JB77qRC4LeAFuyHTjHJQG2Ea...

CVE-2025-15495

creationtimestamp| type| source ---|---|--- 2026-01-09 19:29:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbza7b3pba2c...

(0Day) ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based user interface. By navigating directly to a URL...

NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

Summary XSS risk exists in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push or ui.navigate.history.replace. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into...

CVE-2025-67916

creationtimestamp| type| source ---|---|--- 2026-01-08 11:00:38+00:00| seen| https://gist.github.com/Darkcrai86/f33e08d7cb164fe83746b1bca5b03563 2026-01-08 17:13:56+00:00| seen| Telegram/th--6IaDSr1rDlZynWZbWINS021pVM3F-S9Uc4QWGTyq7M...

CVE-2026-21873

NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.subpages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been...

CVE-2026-21871 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()

NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push or ui.navigate.history.replace. These helpers are documented as History API wrappers for updating the browser URL...

CVE-2026-21880

creationtimestamp| type| source ---|---|--- 2026-01-08 03:14:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbuzayvi7r2x...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2025-1359)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1359 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...

CVE-2026-21691

creationtimestamp| type| source ---|---|--- 2026-01-07 23:21:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbumasypyl2q...

CVE-2025-66560

creationtimestamp| type| source ---|---|--- 2026-01-07 18:58:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbu5lahzmu2q 2026-01-08 08:22:13+00:00| seen| https://gist.github.com/Darkcrai86/e2b7e4c3475865512ebfb005a7a42aa4...

CVE-2025-47339

creationtimestamp| type| source ---|---|--- 2026-01-07 00:46:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbsakjreqp2r 2026-01-07 07:23:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115852613280042209 2026-01-07 16:17:47+00:00| seen|...

PT-2026-2123

Name of the Vulnerable Software and Affected Versions Parsl versions prior to 2026.01.05 Description A SQL Injection issue exists in the parsl-visualize component. The application builds SQL queries using unsafe string formatting with user-supplied input workflow id taken directly from URL routes...

PT-2026-1440

FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or...

CVE-2026-0589

creationtimestamp| type| source ---|---|--- 2026-01-05 14:00:58+00:00| seen| Telegram/OnsG3OkAw79zRAAGEwz-ObL4fanvyYerBQxPUZBTsapiCw 2026-01-05 16:39:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbout5rhid2o...

CVE-2025-14428

creationtimestamp| type| source ---|---|--- 2026-01-01 18:59:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbf2sjn2cp2g 2026-01-02 07:58:30+00:00| seen| https://gist.github.com/Darkcrai86/2ac13fecaef2b028059530932a95c75d...

CVE-2025-69203

creationtimestamp| type| source ---|---|--- 2026-01-01 17:55:51+00:00| published-proof-of-concept| https://github.com/SignalK/signalk-server/security/advisories/GHSA-vfrf-vcj7-wvr8 2026-01-01 22:48:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbfhm5yeka2y 2026-01-02...

CVE-2025-22197

creationtimestamp| type| source ---|---|--- 2026-01-01 05:28:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbdni2pyii2m...

PT-2026-4876

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in libsoup, an HTTP client library, related to CRLF Carriage Return Line Feed Injection. This issue occurs when an HTTP proxy is configured and the library improperly handles...