35352 matches found
EUVD-2026-41997
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...
CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...
CVE-2026-34170
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...
CVE-2026-34170
CVE-2026-34170 affects Coolify before 4.0.0-beta.471, where the GithubApp api_url field is used as the base URL for server-side HTTP requests without proper allowlisting or private IP blocking. An authenticated user can configure a GitHub App source that makes Coolify issue requests to internal s...
CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...
CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...
EUVD-2026-41954
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...
GHSA-V5WF-J8J4-77H7
creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:44+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgei5er2s...
GHSA-9G22-W2GR-VCMP
creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:42+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgcfkjb2s...
CVE-2026-53759
creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:27+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4...
CVE-2026-55426
creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:11+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j...
CVE-2026-55501
creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:05+00:00| published-proof-of-concept| https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7 2026-07-10 16:21:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqckkdhmae2e 2026-07-10 22:20:14+00:00|...
CVE-2026-59710
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...
GHSA-24X4-J6X9-RFW5 Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Summary An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session...
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
Summary An attacker with only a GitHub account can plant a JavaScript payload in a craftcms/cms issue title. When a Craft admin uses the CraftSupport widget’s "Give feedback" screen and types a search term that returns the poisoned issue, the payload executes in the admin’s control panel session...
EUVD-2026-41209
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget...
Cross-site Scripting (XSS)
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CraftSupportWidget.js process. An attacker can execute arbitrary JavaScript code in the admin's control panel session by crafting a malicious GitHub issue tit...
CVE-2026-59710
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...
CVE-2026-55786
creationtimestamp| type| source ---|---|--- 2026-07-06 18:35:06+00:00| published-proof-of-concept| https://github.com/flytohub/flyto-core/security/advisories/GHSA-h9f9-h6gm-wc85 2026-09-15 08:00:37+00:00| exploited|...