1041243 matches found
CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...
CVE-2026-71259
ESPHome (up to 2026.7.0-dev) is affected by an operator-precedence bug in the cv.url() validator within esphome/config_validation.py. The condition if parsed.scheme and parsed.netloc or parsed.scheme == "file" incorrectly permits file:// URIs to bypass validation, affecting the url: field of the ...
CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...
CVE-2026-71259
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...
CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...
EUVD-2026-53344
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.2.hum1 aarch64, x8664 tar-1.35-9.2.hum1.src src...
CVE-2026-71250
Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...
RHSA-2026:50319 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Bulletin has no description...
RHSA-2026:50336 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Bulletin has no description...
RHSA-2026:50318 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update
Bulletin has no description...
RHSA-2026:50281 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2026:50142 Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:50141 Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:49857 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:49838 Red Hat Security Advisory: osbuild-composer security, bug fix, and enhancement update
Bulletin has no description...
RHSA-2026:45940 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2026:2711 Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security and bug fix update
Bulletin has no description...
Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for July 2026.
Summary Security vulnerabilities are addressed with IBM Business Automation Insights 24.0.0-IF008, 25.0.0-IF006 and 26.0.0-IF001. These vulnerabilities have been also adressed in 24.0.1-IF008. Vulnerability Details CVEID:CVE-2026-8723 DESCRIPTION: Summary qs.stringify throws TypeError when called...
CVE-2026-71202
The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...