PT-2026-4876

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in libsoup, an HTTP client library, related to CRLF Carriage Return Line Feed Injection. This issue occurs when an HTTP proxy is configured and the library improperly handles...

CVE-2025-69286

RAGFlow prior to 0.22.0 uses an insecure key generation algorithm for API keys and beta tokens. Both tokens are generated with the same URLSafeTimedSerializer and predictable inputs, so a user with the shared assistant/agent URL can derive the personal API key, granting full control over the owne...

CVE-2025-66150

creationtimestamp| type| source ---|---|--- 2025-12-31 20:39:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbcpwbidou2y...

lfi_tester.py

chmod +x lfitest...

EUVD-2025-205863

Ksenia Security Lares 4.0 version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially...

CVE-2025-55060

CWE-601 URL Redirection to Untrusted Site 'Open Redirect'...

CLSA-2025-1767098873 tomcat: Fix of CVE-2025-55752

CVE-2025-55752: fix path traversal vulnerability in URL normalization and improve QSA/QSD rewrite handling...

CVE-2025-66861

creationtimestamp| type| source ---|---|--- 2025-12-29 16:43:31+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115803855977149298 2025-12-29 18:31:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mb5hsyps3y2q 2026-03-19 00:00:00+00:00| seen|...

GNU Wget2 安全漏洞

GNU Wget2 is a web-based download tool from the American GNU community. A security vulnerability exists in GNU Wget2 that stems from a stack buffer overflow when handling specially crafted URL paths, which could lead to memory corruption...

D-Link DWR-M920 安全漏洞

The D-Link DWR-M920 is a 4GLTE wireless router manufactured by Youxun D-Link. The D-Link DWR-M920 suffers from a buffer overflow vulnerability that stems from the incorrect manipulation of the parameter submit-url in the function sub423848 in the file /boafrm/formParentControl, for which no...

CVE-2025-52599

creationtimestamp| type| source ---|---|--- 2025-12-26 08:42:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mauvjoeptt2y 2026-01-07 19:08:58+00:00| seen| Telegram/0Jzl9Q6YMruvhDow6TT000AAv9kgikcEbuH5cbueyHp7zA...

CVE-2025-68742

creationtimestamp| type| source ---|---|--- 2025-12-24 15:01:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maqjquyax42r 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-02 17:00:00+00:00| seen|...

CVE-2017-20192

creationtimestamp| type| source ---|---|--- 2025-12-24 03:37:55+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2017/CVE-2017-20192.yaml 2025-12-24 09:00:05+00:00| published-proof-of-concept| Telegram/VnCmfh6FKXcDDP1mfmp0-bwK1xebRrswxVAwUN4mR3Zgv8...

Teradek VidiU Pro 安全漏洞

Teradek VidiU Pro is a hardware live streaming encoder from Teradek USA. A security vulnerability exists in Teradek VidiU Pro version 3.0.3, which stems from the mishandling of the url and xmlurl parameters by the management interface, which could lead to a server-side request forgery attack...

CVE-2023-53948

creationtimestamp| type| source ---|---|--- 2025-12-22 00:08:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3majwwkwwjj2f...

CVE-2025-67857

A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure...

CVE-2025-68489

creationtimestamp| type| source ---|---|--- 2025-12-19 07:22:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mad5rqgvir2e...

CVE-2025-67845

A Directory Traversal vulnerability in the Static Asset Proxy Endpoint in Mintlify Platform before 2025-11-15 allows remote attackers to inject arbitrary web script or HTML via a crafted URL containing path traversal sequences...

CVE-2025-52692

Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials...

EUVD-2025-204429

Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials...