65283 matches found
CVE-2026-12466
creationtimestamp| type| source ---|---|--- 2026-06-17 01:56:44+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-56 2026-06-17 05:54:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohmtan24g25 2026-06-21 18:00:00+00:00| seen|...
CVE-2026-48616
creationtimestamp| type| source ---|---|--- 2026-06-17 00:50:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh3tgoovh22 2026-06-27 22:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpcjiqi7ax2x...
CVE-2026-39598
creationtimestamp| type| source ---|---|--- 2026-06-17 00:45:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh3ki2tw62e...
CVE-2026-25470
creationtimestamp| type| source ---|---|--- 2026-06-17 00:21:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moh26rxriy2v...
CVE-2026-49080
creationtimestamp| type| source ---|---|--- 2026-06-17 00:15:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mogzvfr4bj2h...
CVE-2026-48797
creationtimestamp| type| source ---|---|--- 2026-06-17 00:00:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mogyzyan552s 2026-06-17 03:38:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohf6t5rnw25...
Bosch Security Systems IP Cameras Cross-site Scripting (CVE-2021-23848)
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting XSS in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user. This plugin only works with...
FreeBSD : mail/mailpit -- Incomplete SSRF protection in Link Check API via uncovered IPv6 forms (44afeb08-6a18-11f1-9647-10ffe07f9334)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 44afeb08-6a18-11f1-9647-10ffe07f9334 advisory. Mailpit authorreports: The tools.IsInternalIP deny-list relies on Go's stdlib classification helpers...
mail/mailpit -- Incomplete SSRF protection in Link Check API via uncovered IPv6 forms
Mailpit authorreports: The tools.IsInternalIP deny-list relies on Go's stdlib classification helpers IsLoopback, IsPrivate, IsLinkLocalUnicast, IsLinkLocalMulticast, IsUnspecified, IsMulticast plus an inline CGNAT range, but those helpers do not match two classes of IPv6 address that should be...
CVE-2026-48745 Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry
Traccar Client is a GPS tracking mobile app for sending location updates to private servers using the open-source Traccar platform. In versions 9.7.19 and below, a single crafted deep link can silently hijack all GPS tracking parameters and redirect telemetry to an attacker-controlled server. The...
GHSA-7CX2-G3H9-382P
creationtimestamp| type| source ---|---|--- 2026-06-16 21:41:28+00:00| seen| https://gist.github.com/alon710/d499538761d587fbb74d51e5882b31ec...
GHSA-WGPF-JWQJ-8H8P
creationtimestamp| type| source ---|---|--- 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...
GHSA-6XCG-6Q43-RJ2V Duplicate Advisory: Exported session HTML could keep unsafe markdown links
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...
Duplicate Advisory: Exported session HTML could keep unsafe markdown links
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...
GHSA-8988-4F7V-96QF
creationtimestamp| type| source ---|---|--- 2026-06-16 21:24:00+00:00| seen| https://gist.github.com/konard/b5022a7dd742df01e2f9265d5908dcad 2026-06-16 21:33:02+00:00| seen| https://gist.github.com/konard/056d8d6804564c2fffaccf92c7483ba5...
CVE-2026-11409 OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N
An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges...
CVE-2026-11410 OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N
An authenticated OS command injection vulnerability exists in the BigPond Cable BPA WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges...
CVE-2026-11410
The CVE-2026-11410 entry concerns TL-WR940N v6 (BigPond Cable BPA WAN config) with an authenticated OS command injection caused by improper input sanitization in the configuration module. An administrator can trigger arbitrary command execution with elevated privileges on the device via the BPA W...
GHSA-C6MH-FPJC-4PR3 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing the remediation for CVE-2024-38519. Details The fix for CVE-2024-38519 enforced an allowlist for file extensions, in orde...