2403 matches found
CVE-2026-0976
Keycloak contains an improper input validation vulnerability (CVE-2026-0976) where RFC-compliant matrix parameters in URL path segments can be processed in ways that bypass reverse-proxy path filtering, potentially exposing administrative or sensitive endpoints. Affected component commonly cited ...
CVE-2022-50907
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution...
PT-2026-2815
Name of the Vulnerable Software and Affected Versions GetContentFromURL plugin for WordPress versions prior to 1.1 Description The GetContentFromURL plugin for WordPress is susceptible to Server-Side Request Forgery in versions up to and including 1.0. The issue stems from the plugin utilizing wp...
CVE-2025-13393
The Featured Image from URL FIFU plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due to insufficient validation of user-supplied URLs before passing them to the getimagesize function in the Elementor widget integration. This...
CVE-2024-58340
creationtimestamp| type| source ---|---|--- 2026-01-13 02:16:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcbiegwuie2x 2026-03-15 11:48:44+00:00| seen| https://gist.github.com/ragettostudio/85f4f660c32a41c3af0771080e11b64b 2026-03-15 12:22:13+00:00| seen|...
The vulnerability in the cmdOk.xml script of the “Smart Home” system creation platform Lares 4.0 allows a hacker to redirect a user to an arbitrary URL address.
The vulnerability in the cmdOk.xml script of the “Smart Home” system Lares 4.0 involves redirecting the URL to an unreliable website when processing the redirectPage parameter. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL address...
CVE-2026-22799
creationtimestamp| type| source ---|---|--- 2026-01-12 23:03:01+00:00| published-proof-of-concept| Telegram/r1WVj1DWEYgy6-PsI-eM62JB77qRC4LeAFuyHTjHJQG2Eac 2026-01-13 01:33:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcbfxjeoxr2c...
Open Redirect
React Router is vulnerable to Open Redirect. The vulnerability is due to unsafe handling of SPA navigation redirects generated from loaders or actions in certain modes, which allows an attacker to inject untrusted redirect URLs and trigger unintended JavaScript execution on the client...
The vulnerability of Cisco WebEx Meetings software lies in the redirection of URLs to unreliable websites, allowing attackers to redirect users to arbitrary URL addresses.
The vulnerability of Cisco WebEx Meetings software relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...
CVE-2026-22786
creationtimestamp| type| source ---|---|--- 2026-01-11 14:44:05+00:00| published-proof-of-concept| https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-3558-j79f-vvm6 2026-01-12 23:03:01+00:00| published-proof-of-concept| Telegram/r1WVj1DWEYgy6-PsI-eM62JB77qRC4LeAFuyHTjHJQG2Ea...
CVE-2025-15495
creationtimestamp| type| source ---|---|--- 2026-01-09 19:29:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbza7b3pba2c...
(0Day) ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web-based user interface. By navigating directly to a URL...
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
Summary XSS risk exists in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push or ui.navigate.history.replace. These helpers are documented as History API wrappers for updating the browser URL without page reload. However, if the URL argument is embedded into...
CVE-2025-67916
creationtimestamp| type| source ---|---|--- 2026-01-08 11:00:38+00:00| seen| https://gist.github.com/Darkcrai86/f33e08d7cb164fe83746b1bca5b03563 2026-01-08 17:13:56+00:00| seen| Telegram/th--6IaDSr1rDlZynWZbWINS021pVM3F-S9Uc4QWGTyq7M...
CVE-2026-21873
NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.subpages allows an attacker to manipulate the fragment identifier of the URL, which they can do despite being cross-site, using an iframe. This issue has been...
CVE-2026-21871 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled strings into ui.navigate.history.push or ui.navigate.history.replace. These helpers are documented as History API wrappers for updating the browser URL...
CVE-2026-21880
creationtimestamp| type| source ---|---|--- 2026-01-08 03:14:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbuzayvi7r2x...
Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2025-1359)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1359 advisory. Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which a...
CVE-2026-21691
creationtimestamp| type| source ---|---|--- 2026-01-07 23:21:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbumasypyl2q...
CVE-2025-66560
creationtimestamp| type| source ---|---|--- 2026-01-07 18:58:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbu5lahzmu2q 2026-01-08 08:22:13+00:00| seen| https://gist.github.com/Darkcrai86/e2b7e4c3475865512ebfb005a7a42aa4...