66102 matches found
CVE-2026-8695
creationtimestamp| type| source ---|---|--- 2026-05-16 16:00:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mly7ql4tit2n...
CVE-2026-8686
creationtimestamp| type| source ---|---|--- 2026-05-16 13:03:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxvqfdpmi2w...
CVE-2026-44348
creationtimestamp| type| source ---|---|--- 2026-05-16 11:46:51+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mlxrlcxp2r2b...
CVE-2026-7371
creationtimestamp| type| source ---|---|--- 2026-05-16 11:02:04+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mlxp2le4n222 2026-06-15 19:00:22+00:00| seen| https://infosec.place/objects/262c4e67-33ea-4311-bc3e-90ca7ce4f4b4...
CVE-2026-44552
creationtimestamp| type| source ---|---|--- 2026-05-16 11:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxoztzg2r2c...
CVE-2026-45035
creationtimestamp| type| source ---|---|--- 2026-05-16 06:02:35+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlx67zbdpu2m...
Cross-site Scripting (XSS)
FileBrowser Quantum is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of user-controlled share metadata fields when rendered in HTML using text/template, which allows an attacker to inject and execute malicious scripts when users visit a shared URL...
Arbitrary File Read
go-getter is vulnerable to Arbitrary File Read. The vulnerability is due to improper validation of maliciously crafted Git URLs during certain Git operations, where specially crafted URLs can access unintended file system paths, allowing attackers to read arbitrary files on the host system...
PT-2026-41435
WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject...
CVE-2026-8700
creationtimestamp| type| source ---|---|--- 2026-05-15 23:50:50+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlwjky4azi24...
CVE-2026-45314
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profileimageurl values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves...
CVE-2026-44551
creationtimestamp| type| source ---|---|--- 2026-05-15 21:55:17+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mlwd4e4gaz2f 2026-05-16 11:01:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlxozn5c3m2n 2026-05-18 20:07:20+00:00| seen|...
CVE-2026-45299 Open WebUI: Stored Cross-Site Scripting In Profile Picture
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, the profileimageurl field on the user profile update form accepted arbitrary data: URI values without MIME-type validation, resulting in a XSS vulnerability. This vulnerability is...
CVE-2026-45314 Open WebUI: XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profileimageurl values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves...
GHSA-VFVV-C25P-M7MM
creationtimestamp| type| source ---|---|--- 2026-05-15 21:10:29+00:00| seen| https://gist.github.com/alon710/eb93d50b17daa578bcc910ffc0480f36...
GHSA-RC6V-5RMX-W5MV
creationtimestamp| type| source ---|---|--- 2026-05-15 20:40:29+00:00| seen| https://gist.github.com/alon710/7369a43661d2464459ab6b6fcb329366...
CVE-2026-42590
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.30.0, The ExifTool metadata write blocklist in Gotenberg can be bypassed using ExifTool's group-prefix syntax, enabling arbitrary file rename, move, hardlink, and symlink creation on the server. ExifTool supports group-prefix...
GHSA-MQ5J-PW29-JCV3
creationtimestamp| type| source ---|---|--- 2026-05-15 18:40:29+00:00| seen| https://gist.github.com/alon710/603dfdf0e01af88d7ae6413c9f3332fe...
EUVD-2026-30587
Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful. From 0.2.0 to before 0.10.0, collaborators.list, tables.metadata.list, explorations.list, and forms.list accept a databaseid without verifying that the requesting user was a collaborator on that...