EUVD-2026-66389

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-80350

OneUptime before version 12.0.7 contains a Server-Side Request Forgery (SSRF) vulnerability in its webhook delivery path. The host-literal screening in Common/Server/Utils/SSRFProtection.ts (function isBlockedHostnameLiteral) rejects private and loopback IPv4 addresses and a limited set of IPv6 f...

CVE-2026-80350 OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.72 packages and security update

Red Hat OpenShift Container Platform release 4.14.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Choose your fighter: Balancing competing requirements to select models for your AI SOC

Selecting a model for your security operations center SOC and digital forensics and incident response DFIR tasks is important, but selecting the best one is more involved than you might think. SOC tasks rely on a combination of model efficacy, analysis time, cost, and consistency of results. Cisc...

Exploits and vulnerabilities in Q2 2026

The vulnerability landscape shifted significantly in Q2 2026. First, the number of registered CVEs reached an unprecedented level. This is driven primarily by the widespread adoption of AI, both for application development and search for security flaws. This resulted in entire new classes of...

vulnerabilities in Next.js

Vercel has identified two vulnerabilities in Next.js, a React framework for developing web applications. A malicious actor could exploit these vulnerabilities to execute arbitrary code on the application server. These vulnerabilities only exist in Next.js applications hosted in a Windows...

OpenAI Bans Russian ChatGPT Accounts Used to Run Influence Operation

OpenAI on Tuesday said it banned a cluster of Russian ChatGPT accounts that used VPNs to bypass access restrictions and run an influence operation, which relied on its artificial intelligence AI tool to generate social media posts and comments that were shared on Substack, Telegram, X, Facebook a...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Integrated Analytics System as a lightweight Java-based web server and Servlet engine. Multiple vulnerabilities affect Eclipse Jetty across its HTTP handling, URI parsing, and authentication modules. CVE-2024-6763 involves insufficient validation of the URI...

log4j-4255

log4j2 4255 — FilteredObjectInputStream allowlist bypass vi...

Exploit for CVE-2026-53613

CVE-2026-53613 PoC TOCTOU vulnerability in mount8 allowing...

K000163109: Linux kernel vulnerability CVE-2026-53025

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases t...

Trust-Decision-Security

Trust Decision Solver - Reverse Engineering Questo software ti permette di Generare impronte digitali dinamiche infinite Generare token di passaggio TD infiniti senza rilevamento Alcune delle vulnerabilità di sicurezza web includono: Controlli delle impronte TLS non presenti sul dominio dei token...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.72 security and extras update

Red Hat OpenShift Container Platform release 4.14.72 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a security impact of...

Beware of fake Indeed interview apps used to install spyware

From several independent reports, we’ve seen evidence of scammers using fake Android “interview” apps to target job seekers on the Indeed platform. Indeed is one of the world's largest employment websites, giving scammers access to a huge pool of potential victims, especially in a competitive job...

CVE-2024-46507

Lo script è stato testato e costruito su Ubuntu Server 20.04 LTS, mentre Kali Linux è stato utilizzato per lo sfruttamento e la guida dettagliata. Questa guida ti accompagna attraverso lo sfruttamento del server vulnerabile contenente le vulnerabilità CVE-2024-46507 iniezione di comandi e...

CVE-2023-37800

Nicht in Anführungszeichen gesetzter Dienstpfad in Fortect - 5.0.0.7 - CVE-2023-37800 Nicht in Anführungszeichen gesetzter Dienstpfad in Fortect - 5.0.0.7 Entdecker: Idan Malihi Beschreibung Die Komponente MainService.exe ist anfällig für einen nicht in Anführungszeichen gesetzten Dienstpfad:...

CVE_2022_46395_Gazelle

Exploit per CVE-2022-46395 da eseguire su FireTV Cube di 3ª generazione Questo è un fork del POC per Pixel 6 del ricercatore di sicurezza Man Yue Mo per CVE-2022-46395. Leggi il suo articolo dettagliato sulla vulnerabilità qui. Sono state apportate modifiche per tenere conto dello spazio utente a...