CVE-2026-67616

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-66065

creationtimestamp| type| source ---|---|--- 2026-08-03 22:02:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gmxn7ldiwvsva...

GHSA-CQ5V-8Q36-5273

creationtimestamp| type| source ---|---|--- 2026-08-03 21:32:44+00:00| seen| https://gist.github.com/alon710/cb22e8e296a36049522556dbfd0c36bc...

CVE-2026-18736

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

CVE-2026-67598

creationtimestamp| type| source ---|---|--- 2026-08-03 20:55:02+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7f2blmgt2q 2026-08-03 21:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms7fgvrgmd2i 2026-08-07 10:04:24+00:00|...

EUVD-2026-52427

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

CVE-2026-18736 Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

CVE-2026-18736

Technical details about CVE-2026-18736 are not publicly available in the provided documents. Monitor for updates for affected products, versions, impact specifics, and remediation guidance.

CVE-2026-67609

creationtimestamp| type| source ---|---|--- 2026-08-03 19:59:03+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ms7bw6w6qd2v...

GHSA-JJ27-H5HQ-8X99

creationtimestamp| type| source ---|---|--- 2026-08-03 19:31:37+00:00| seen| https://gist.github.com/alon710/bdd530b55ab23396bc2ee2dc380962dc...

CVE-2026-51785

creationtimestamp| type| source ---|---|--- 2026-08-03 18:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms766fxfxh2m...

CVE-2026-12965

creationtimestamp| type| source ---|---|--- 2026-08-03 17:54:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72wozp2t2o...

CVE-2025-69946

creationtimestamp| type| source ---|---|--- 2026-08-03 17:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms72pkjtn22z...

CVE-2026-69152

creationtimestamp| type| source ---|---|--- 2026-08-03 17:31:36+00:00| seen| https://gist.github.com/alon710/d80e5d80b7549449b84a63552411d4ec 2026-08-03 18:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hlxnpa6jl7kfg 2026-08-04 12:00:52+00:00| seen|...

CVE-2026-69149

creationtimestamp| type| source ---|---|--- 2026-08-03 16:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6xhtypny2p 2026-08-03 18:14:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5nwaq22vg5q3w 2026-08-05 02:26:04+00:00| seen|...

GHSA-JHPW-976M-542J

creationtimestamp| type| source ---|---|--- 2026-08-03 16:32:48+00:00| seen| https://gist.github.com/alon710/73fc02db3c552514344a681ca47f8151...

CVE-2026-68584

creationtimestamp| type| source ---|---|--- 2026-08-03 14:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyg64yp2u...

CVE-2025-15675

creationtimestamp| type| source ---|---|--- 2026-08-03 14:22:13+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3ms6p3utr552u...

CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...