Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the chromium/convert/url endpoint due to insufficient validation of redirect destinations against the deny-list. An attacker can access internal network resources and sensitive endpoints by supplying ...

CVE-2026-46481

creationtimestamp| type| source ---|---|--- 2026-05-14 15:37:25+00:00| published-proof-of-concept| https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-9vmh-whc4-7phg 2026-06-08 19:49:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnshblm7jb2r...

CVE-2026-46477

creationtimestamp| type| source ---|---|--- 2026-05-14 14:18:06+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5h9v-837x-m97r 2026-06-08 17:24:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns75tvowx2z...

CVE-2026-46476

creationtimestamp| type| source ---|---|--- 2026-05-14 14:17:36+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-728h-4mwj-f2p4 2026-06-08 17:11:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mns6gihbi32r...

GHSA-Q58J-G3F4-H26H CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

Summary The GitHub Actions workflow .github/workflows/static.yml uses the pullrequesttarget trigger but dangerously checks out the unverified code from the pull request head ref: $ github.event.pullrequest.head.ref . Subsequently, it executes a script bin/console from this untrusted checkout. Thi...

CVE-2026-45799

creationtimestamp| type| source ---|---|--- 2026-05-14 11:34:06+00:00| published-proof-of-concept| https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9 2026-07-18 16:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwn5e65f52f...

CVE-2026-46430

creationtimestamp| type| source ---|---|--- 2026-05-14 09:10:41+00:00| published-proof-of-concept| https://github.com/xyproto/algernon/security/advisories/GHSA-gj84-924c-48fx...

WS-2019-0431

Github-jquery-widgets, version 0.1.2 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...

WS-2019-0430

Github-jquery-widgets, version 0.1.2 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...

CVE-2026-46426

creationtimestamp| type| source ---|---|--- 2026-05-14 08:35:54+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf 2026-05-27 19:19:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmu7ynnjzd2q...

CVE-2026-45709

creationtimestamp| type| source ---|---|--- 2026-05-14 04:53:50+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc...

CVE-2026-45139

creationtimestamp| type| source ---|---|--- 2026-05-14 01:57:46+00:00| published-proof-of-concept| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5...

GHSA-V9JR-RG53-9PGP vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server...

GHSA-66FF-XGX4-VCHM vulnerabilities

Vulnerabilities for packages: renovate, vitess, kubeflow-centraldashboard, pulumi...

GHSA-V974-2CJF-22Q5 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-vmware...

CVE-2026-44428: Server-Side Request Forgery (SSRF)

The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher...

PT-2026-41129

Name of the Vulnerable Software and Affected Versions shivammathur/setup-php versions 2.25.0 through 2.37.0 Description Command injection is possible when the action resolves the PHP version from repository-controlled files and incorporates these values into generated shell or PowerShell setup...

CVE-2026-46378

creationtimestamp| type| source ---|---|--- 2026-05-13 20:50:17+00:00| published-proof-of-concept| https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64 2026-07-16 19:41:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrykn3wqb22...

CVE-2026-46377

creationtimestamp| type| source ---|---|--- 2026-05-13 20:39:40+00:00| published-proof-of-concept| https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq 2026-07-16 19:58:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrzidqrfn2w...

MAL-2026-3702 Malicious code in async-http-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 85e8a68bad6595a817f1dabed757662e2a04cfec7b45a86d9bfd61a7a78d14d1 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...