Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root

Summary The make:controller CLI command calls mkdir..., recursive: true on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect...

GHSA-3XJV-PMF2-GF2Q Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root

Summary The make:controller CLI command calls mkdir..., recursive: true on a path built from the user-supplied controller name, before Nette's class-name validation runs. The class-file write is correctly rejected by Nette when the name contains /, but the recursive directory creation side effect...

CVE-2026-40281

Gotenberg 8.x (

CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate...

CVE-2026-40281 Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate...

CVE-2026-43575

creationtimestamp| type| source ---|---|--- 2026-05-06 20:43:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7kv7aqay2l 2026-05-07 02:03:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mla4rxxyf72p 2026-05-07 18:07:08+00:00| seen|...

Cross-site Scripting (XSS)

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS in the FAQ creation and update process. An attacker can execute arbitrary JavaScript in the browsers of users who view maliciou...

Cross-site Scripting (XSS)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS in the FAQ creation and update process. An attacker can execute arbitrary JavaScript in the browsers of users who view maliciou...

CVE-2025-63704

creationtimestamp| type| source ---|---|--- 2026-05-06 19:53:03+00:00| seen| https://gist.github.com/6en6ar/d62f614dbb2b1032b5e45a56fe26ec8b...

GHSA-9G2Q-W3W2-VF7Q

creationtimestamp| type| source ---|---|--- 2026-05-06 19:40:28+00:00| seen| https://gist.github.com/alon710/30aa8db3db1787262bc908c85e9c7fec...

GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository

🧾 Summary A vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and...

CVE-2026-5324

creationtimestamp| type| source ---|---|--- 2026-05-06 19:33:15+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3ml7gxtpxis2a...

CVE-2026-20035

creationtimestamp| type| source ---|---|--- 2026-05-06 19:31:15+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ml7guk2ryo2v 2026-05-07 00:53:19+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-cisco-24 2026-05-07 14:40:13+00:00| seen|...

GHSA-VRQV-52X7-RM4V

creationtimestamp| type| source ---|---|--- 2026-05-06 19:10:29+00:00| seen| https://gist.github.com/alon710/ddc2dae3143b446acfb966905cf3bf2f...

CVE-2025-66369

creationtimestamp| type| source ---|---|--- 2026-05-06 19:00:25+00:00| seen| https://mastodon.social/ap/users/115755483699003887/statuses/116529167159124842 2026-05-10 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities20260511...

CVE-2026-13431

creationtimestamp| type| source ---|---|--- 2026-05-06 19:00:13+00:00| seen| Telegram/JKuQ4eIVkQaxCwqSFRly8E-V03TP17f0rDPWjekpSnDxnA...

CVE-2026-8027

creationtimestamp| type| source ---|---|--- 2026-05-06 18:01:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml7bubgd5g2t...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the condition process. An attacker can execute arbitrary commands on the server by injecting malicious...

GHSA-QRGM-P9W5-RRFW Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior

We identified a vulnerability in the latest version of Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. Yii’s dynamic object configuration, as implemented in...

CVE-2026-43278

creationtimestamp| type| source ---|---|--- 2026-05-06 17:25:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116528795236956577 2026-05-07 11:52:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116533148086350826 2026-07-02 06:18:13+00:00| seen|...