CVE-2026-48013

CVE-2026-48013 (Shopware) is an SSRF in the media external-link flow. Authenticated admins can cause server-side HEAD requests from the endpoint /api/_action/media/external-link to arbitrary internal IPs, bypassing the existing depth of IP checks used by the parallel uploadFromURL flow. The vulne...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-62548

creationtimestamp| type| source ---|---|--- 2026-07-23 18:20:56+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61122

creationtimestamp| type| source ---|---|--- 2026-07-23 18:15:05+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-27 15:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrn7zczya523...

CVE-2026-44909

creationtimestamp| type| source ---|---|--- 2026-07-23 18:10:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdgqdqney2c 2026-07-23 19:42:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdluqw6m72f...

CVE-2026-61090

creationtimestamp| type| source ---|---|--- 2026-07-23 17:52:13+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61053

creationtimestamp| type| source ---|---|--- 2026-07-23 17:51:25+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60828

creationtimestamp| type| source ---|---|--- 2026-07-23 17:47:42+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60446

creationtimestamp| type| source ---|---|--- 2026-07-23 17:16:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 17:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrftpac2nn2y 2026-07-25 12:07:06+00:00| seen|...

CVE-2026-60436

creationtimestamp| type| source ---|---|--- 2026-07-23 17:16:32+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-65697

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-60384

creationtimestamp| type| source ---|---|--- 2026-07-23 17:15:27+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 18:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrfxpybzca2r 2026-07-29 11:37:07+00:00| seen|...

CVE-2026-14257

creationtimestamp| type| source ---|---|--- 2026-07-23 17:02:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvmlwzj22 2026-07-24 22:35:03+00:00| published-proof-of-concept| https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg...

CVE-2026-61178

creationtimestamp| type| source ---|---|--- 2026-07-23 16:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdchceyni2y 2026-07-23 18:16:57+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61175

creationtimestamp| type| source ---|---|--- 2026-07-23 16:52:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcdqyu3n2v 2026-07-23 18:16:55+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61174

creationtimestamp| type| source ---|---|--- 2026-07-23 16:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcdps45p24 2026-07-23 18:16:52+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-65901

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:21+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-x4vx-rjvf-j5p4...

CVE-2026-65902

creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:19+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-76mc-f452-cxcm...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65689

creationtimestamp| type| source ---|---|--- 2026-07-23 15:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrd4cmiw522q 2026-07-23 16:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrd7hza4il2a 2026-07-29 22:07:06+00:00| seen|...