CVE-2026-63135

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

CVE-2026-63135

YOURLS (self-hosted PHP URL shortener) versions 1.5.1 through 1.10.4 are affected by a stored cross-site scripting (XSS) vulnerability in the referrer statistics chart. The root cause is that the chart builder concatenates referrer-derived domain labels into inline JavaScript without proper strin...

CVE-2026-63135 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourlsgetreferrer, yourlssanitizeurlsafe, and yourlslogredirect, then aggregates the value in yourls-infos.php and passes the derived domain through...

EUVD-2026-64136

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-62316 Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

CVE-2026-62316 Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/httpservers/linuxmcpserver.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An...

Security Bulletin: IBM i is Affected By Holding Resources after Effective Lifetime Vulnerability in Electronic Service Agent [CVE-2026-64607]

Summary Electronic Service Agent for IBM i uses HttpClient for HTTP message handling. HttpClient is vulnerable to not releasing underlying resources when encountering an invalid or unsupported 'Content-Encoding' header value CVE-2026-64607 as described in the vulnerability details section...

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Summary Unleash's addon/integration subsystem lets an operator configure a webhook and the Slack, Microsoft Teams, Datadog, and New Relic integrations with a target url parameter. Whenever a subscribed feature-flag event fires, the Unleash server itself issues an HTTP request to that configured...

GHSA-5VF6-JRQR-78FJ Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Summary Unleash's addon/integration subsystem lets an operator configure a webhook and the Slack, Microsoft Teams, Datadog, and New Relic integrations with a target url parameter. Whenever a subscribed feature-flag event fires, the Unleash server itself issues an HTTP request to that configured...

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

dsh2shell

dsh2shell Unauthenticated RCE PoC for expo...

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

Exploit for CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Eclipse Jetty

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Eclipse Jetty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2024-7708 DESCRIPTION: For requests that have a body, but reading the body may end up in reading 0 bytes...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.2 Vulnerability Details CVEID:CVE-2022-40152 DESCRIPTION: Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks DOS if DTD support is enabled. If the parser is running on user suppli...