CVE-2026-103437

CVE-2026-103437: ReadingLists imported canonical URL XSS Reporter: Marco Paciaroni BomboBombone. ReadingLists accepted an imported project URL and used the response's canonicalurl as a card link without checking its scheme. A signed-in visitor who opened a crafted import link and clicked the card...

PT-2026-81034

Name of the Vulnerable Software and Affected Versions OneNav version 1.2.4 Description An authenticated user can perform arbitrary file deletion through the import link function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerabilit...

SUSE CVE-2026-30832

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP addresses by running repo import with a crafted --lfs-endpoint URL. The initial batch request is...