CVE-2026-48148

creationtimestamp| type| source ---|---|--- 2026-05-21 08:44:47+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-cv96-5348-p5p8 2026-05-27 19:35:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmuavyucc42o...

CVE-2026-4858 Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token.

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action...

CVE-2026-44051

An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files via attacker-controlled symlink creation...

GHSA-C2C9-MFW7-P8HW

creationtimestamp| type| source ---|---|--- 2026-05-21 05:40:51+00:00| seen| https://gist.github.com/alon710/feabaa614915bfed4bc482d4a78d8681...

CVE-2018-8740

creationtimestamp| type| source ---|---|--- 2026-05-21 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-141-03...

CVE-2026-9150

creationtimestamp| type| source ---|---|--- 2026-05-21 02:36:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmdf6lbaxp2v 2026-06-05 13:35:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnkaxh5hdb2j 2026-06-09 12:00:58+00:00| seen|...

GHSA-F5X6-7QGP-JHF3

creationtimestamp| type| source ---|---|--- 2026-05-21 00:45:42+00:00| seen| https://gist.github.com/FuzzysTodd/4e10f5b327d09a37dc02a2a08f442f94...

PT-2026-42581

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1 Description Stored Cross-Site Scripting XSS occurs via the 'external-link' page cvName because the updateCollectionAliasExternal function bypasses sanitization. Stored XSS is a flaw where malicious scripts...

Netatalk 后置链接漏洞

Netatalk is an open-source software developed by Netatalk Inc. It provides AFP file server functionality for Classic Mac OS and macOS on Unix-like operating systems. Versions 3.0.2 to 4.4.2 of Netatalk had a post-release vulnerability due to improper link resolution. This vulnerability could allo...

PT-2026-44135

Name of the Vulnerable Software and Affected Versions symfony/html-sanitizer versions prior to 5.4 Description Three bypasses allow content authors to smuggle URLs that are not on the allowlist past sanitization checks. The first bypass occurs because UrlSanitizer::parse follows RFC-3986, whereas...

Trend Micro Apex One 后置链接漏洞

Trend Micro Apex One is a terminal protection software developed by Trend Micro, a US-based company. Trend Micro Apex One has a postback link vulnerability, which stems from issues with the scanning engine’s link tracking mechanism. This vulnerability may allow local attackers to gain elevated...

CVE-2026-8632

creationtimestamp| type| source ---|---|--- 2026-05-20 22:53:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcyo6kin52p 2026-05-22 22:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmhwoaxvcv2q 2026-05-28 10:44:28+00:00| seen|...

CVE-2026-40092

creationtimestamp| type| source ---|---|--- 2026-05-20 22:44:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcy7grcig2r...

CVE-2026-9129

creationtimestamp| type| source ---|---|--- 2026-05-20 21:07:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcsqz245d2p...

CVE-2026-9136

creationtimestamp| type| source ---|---|--- 2026-05-20 20:57:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcs744lqz2p...

CVE-2026-26028

CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incomplete attribute filtering on restricted tags. The sanitizer validates only the src attribute of , , and elements, leaving all other...

EUVD-2026-31176

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the ticketid GET parameter directly into an HTML attribute. Attackers can craft a...

GHSA-GP95-J463-VV28

creationtimestamp| type| source ---|---|--- 2026-05-20 19:10:50+00:00| seen| https://gist.github.com/alon710/ab000f54d49f4216c2a377595eab5831...

GO-2026-4966 monetr: Server-side request forgery in Lunch Flow link creation and refresh in github.com/monetr/monetr

monetr: Server-side request forgery in Lunch Flow link creation and refresh in github.com/monetr/monetr...

CVE-2026-7613

creationtimestamp| type| source ---|---|--- 2026-05-20 19:03:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcluegihp2r 2026-05-25 02:12:57+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnfpf2cmd2i...