CVE-2026-54513

creationtimestamp| type| source ---|---|--- 2026-06-23 21:59:11+00:00| seen| https://bsky.app/profile/suriq.io/post/3moyfja6qza2l 2026-06-23 23:58:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moym72ggiz2y 2026-07-04 04:24:54+00:00| seen|...

CVE-2026-47382

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses including IPv4-mapped IPv6 forms and...

CVE-2026-46551

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path in the v1/v2 attachment API did not enforce NCATTACHMENTFIELDSIZE against the remote content-length or against the response stream. An authenticated user Editor+ could direct the server to downloa...

CVE-2026-24887

creationtimestamp| type| source ---|---|--- 2026-06-23 21:00:12+00:00| seen| https://gist.github.com/NikosRig/b4330ceb780fe22bf3c14f38d7d90795...

CVE-2020-9695

creationtimestamp| type| source ---|---|--- 2026-06-23 20:54:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybvvwkbh2q...

CVE-2026-55249

creationtimestamp| type| source ---|---|--- 2026-06-23 20:49:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybmxdeit2j 2026-07-02 08:05:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnl5nomc72l...

CVE-2020-9711

creationtimestamp| type| source ---|---|--- 2026-06-23 20:44:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moybdytmff2j...

CVE-2026-47378

CVE-2026-47378 concerns NocoDB, where before 2026.04.1 public shared-view endpoints could expose hidden-column values through three paths: (1) groupBy could return raw values for any column named in the request, (2) filter and sort arrays operated on hidden columns allowed boolean-blind extractio...

CVE-2026-54322

creationtimestamp| type| source ---|---|--- 2026-06-23 20:20:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7xvxbae2l...

CVE-2026-47382 NocoDB: Server-Side Request Forgery via Database Connection Host

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses including IPv4-mapped IPv6 forms and...

CVE-2026-47382

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses including IPv4-mapped IPv6 forms and...

CVE-2026-47382

CVE-2026-47382 concerns NocoDB, where the connection-test endpoint allowed SSRF by opening a raw TCP socket to a user-supplied database host without DNS resolution and range checks. This could reach private/link-local addresses (including IPv4-mapped IPv6 and localhost) before a fix. The issue is...

CVE-2026-54157

creationtimestamp| type| source ---|---|--- 2026-06-23 20:17:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7tridr52f...

CVE-2026-54319

creationtimestamp| type| source ---|---|--- 2026-06-23 20:09:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7frrskd24...

CVE-2026-54320

creationtimestamp| type| source ---|---|--- 2026-06-23 20:08:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7cs26fp2f...

CVE-2022-29503

creationtimestamp| type| source ---|---|--- 2026-06-23 19:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moy3vkwgo22a...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

CVE-2026-12957

creationtimestamp| type| source ---|---|--- 2026-06-23 17:54:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxxui6sh62t 2026-06-25 14:56:43+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mp4otnuzjr2v 2026-06-26 14:34:55+00:00| seen|...

CVE-2026-56116

dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information handling that allows an unauthenticated same-link attacker to cause denial of service by sending crafted Router Advertisements. Attackers can repeatedly send...

GHSA-89MR-XQFV-758M Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

Summary Repository.UploadRepoFiles checks for symlinks only on the leaf of the upload target osx.IsSymlinktargetPath. The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component — UploadRepoFiles is the lone outlier. An attacker with repo-wri...