CVE-2026-62223

creationtimestamp| type| source ---|---|--- 2026-07-17 03:05:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsrdon7ah2c...

CVE-2026-46353 BigBlueButton API checksum bypass via presentationUploadExternalUrl

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some...

CVE-2018-5852

creationtimestamp| type| source ---|---|--- 2026-07-15 21:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqpojzbm2r22...

CVE-2026-61835

creationtimestamp| type| source ---|---|--- 2026-07-15 16:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqp3qtot4l2i...

GHSA-JV8R-GQR9-68WJ

creationtimestamp| type| source ---|---|--- 2026-07-06 19:19:40+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpysnxoqkx22 2026-07-07 00:01:32+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcfyt62f2d...

CVE-2026-53430

creationtimestamp| type| source ---|---|--- 2026-06-16 00:38:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moekog4et52f...

CVE-2026-46700

creationtimestamp| type| source ---|---|--- 2026-06-12 20:16:43+00:00| published-proof-of-concept| https://github.com/actualbudget/actual/security/advisories/GHSA-3f62-qv96-4p78...

CVE-2026-11845

creationtimestamp| type| source ---|---|--- 2026-06-12 00:57:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10970-e4b21-2.html...

CVE-2026-28301

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website...

SolarWinds Observability Self-Hosted 输入验证错误漏洞

SolarWinds Observability Self-Hosted is an observability platform developed by the American company SolarWinds. SolarWinds Observability Self-Hosted has a vulnerability related to input validation errors. This vulnerability arises when attackers can provide a specially crafted external URL,...

CVE-2026-8139

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with vector...

GHSA-GQ96-5PFX-F4VC Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Summary The /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against private/reserved ranges via FileUrlValidator, the linkURL flow only...

Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Summary The /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against private/reserved ranges via FileUrlValidator, the linkURL flow only...

CVE-2026-10861

An open redirect vulnerability existed in MISP UsersController::routeafterlogin because the value stored in the preloginrequestedurl session key was used as the post-login redirect destination without sufficiently enforcing that it was a local application path. An unauthenticated remote attacker...

PT-2026-46889

Summary The /api/ action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against private/reserved ranges via FileUrlValidator, the linkURL flow only...

PT-2026-46863

Summary The /api/ action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against private/reserved ranges via FileUrlValidator, the linkURL flow only...

EUVD-2026-31380

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with...

CVE-2026-8139

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with...

CVE-2026-8139

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with...

CVE-2026-8139 Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.0 with...