58945 matches found
CVE-2026-50015
creationtimestamp| type| source ---|---|--- 2026-06-25 18:30:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp52rdwmyw2u 2026-06-27 00:35:29+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-rxhj-4m44-96r4 2026-06-29 23:01:49+00:00| seen|...
CVE-2026-50021
creationtimestamp| type| source ---|---|--- 2026-06-25 18:20:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp52ap4dzc2z 2026-06-27 00:35:37+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3...
CVE-2026-6091
creationtimestamp| type| source ---|---|--- 2026-06-25 18:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zzxq2wn2f...
CVE-2026-9179
creationtimestamp| type| source ---|---|--- 2026-06-25 18:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4zy7pl6f2w...
CVE-2026-55697
creationtimestamp| type| source ---|---|--- 2026-06-25 18:13:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4ztxnb3j2o 2026-06-27 00:35:14+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27x...
EUVD-2026-39527
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...
CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...
CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...
CVE-2024-11171
creationtimestamp| type| source ---|---|--- 2026-06-25 18:00:46+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mp4z4qzesk2h...
CVE-2026-54089 File Browser: Authentication Bypass via Proxy Auth Header Forgery
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server...
CVE-2026-54089
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server...
CVE-2026-54089
CVE-2026-54089 impacts File Browser when configured with proxy authentication (auth.method=proxy). The issue allows an unauthenticated attacker who can reach the server to impersonate any user—including an administrator—by sending a single forged HTTP header. No credentials are required. Addition...
CVE-2026-54089 File Browser: Authentication Bypass via Proxy Auth Header Forgery
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server...
CVE-2026-54089 File Browser: Authentication Bypass via Proxy Auth Header Forgery
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server...
CVE-2026-54096
File Browser exposes a vulnerability: an authenticated user can create a public share for a path that does not yet exist, and that share becomes valid later when a file is created at that path, potentially exposing future files via GET /api/public/dl/. The issue is triggered by POST /api/share/, ...
CVE-2026-54096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, POST /api/share/ accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target fi...
CVE-2026-54096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, POST /api/share/ accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target fi...
CVE-2026-55439
Halo is an open source website building tool. Prior to 2.24.3, a path traversal vulnerability in the backup download endpoint allows authenticated administrators to read arbitrary files from the server filesystem. The backup download endpoint GET...