CVE-2026-0560

A Server-Side Request Forgery SSRF vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the /api/files/export-content endpoint. The downloadimagetotemp function in backend/routers/files.py fails to validate user-controlled URLs, allowing attackers to make arbitrary HTT...

CVE-2026-29925

creationtimestamp| type| source ---|---|--- 2026-03-30 20:10:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3michtiska42g 2026-03-30 21:00:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3micklfd7jq2x 2026-03-30 21:38:32+00:00| seen|...

GHSA-Q6JJ-R49P-94FH AVideo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification

Summary The getapivideofile and getapivideo API endpoints in AVideo return full video playback sources direct MP4 URLs, HLS manifests for password-protected videos without verifying the video password. While the normal web playback flow enforces password checks via the CustomizeUser::getModeYouTu...

Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the RAG search tools not properly validating user-supplied URLs at runtime. An attacker can access internal or cloud resources by supplying...

Server-side Request Forgery (SSRF)

Overview crewai is a Cutting-edge framework for orchestrating role-playing, autonomous AI agents. By fostering collaborative intelligence, CrewAI empowers agents to work together seamlessly, tackling complex tasks. Affected versions of this package are vulnerable to Server-side Request Forgery SS...

CVE-2026-2286 CVE-2026-2286

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime...

CVE-2026-2286 CVE-2026-2286

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime...

CVE-2026-2286 CVE-2026-2286

CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime...

RHSA-2026:2984

creationtimestamp| type| source ---|---|--- 2026-03-30 14:35:01+00:00| seen| https://gist.github.com/fao89/0ef4daafb58f204bb3f4b9361f75d68c 2026-03-30 14:50:35+00:00| seen| https://gist.github.com/fao89/ce009677a07abdc70b85a5ec1d9a9b85...

CVE-2026-31893

creationtimestamp| type| source ---|---|--- 2026-03-30 13:23:42+00:00| seen| https://infosec.exchange/users/raptor/statuses/116318340503071355 2026-03-30 13:23:52+00:00| seen| https://bsky.app/profile/raptor.infosec.exchange.ap.brid.gy/post/3mibr3ebgghd2 2026-03-30 21:27:43+00:00| seen|...

CVE-2025-15379

creationtimestamp| type| source ---|---|--- 2026-03-30 08:15:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mib7utglid23 2026-03-30 08:35:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mibaxfkcfz25 2026-03-30 09:16:37+00:00| seen|...

CVE-2026-3124

creationtimestamp| type| source ---|---|--- 2026-03-30 02:20:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mialzmanvq2c 2026-03-30 03:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116315889917405260 2026-03-30 03:00:31+00:00| seen|...

Gotenberg 代码问题漏洞

Gotenberg is an open-source, developer-friendly API developed by Gotenberg. It is used to convert various document formats into PDF files. Versions of Gotenberg prior to 8.29.0 contained code vulnerabilities. These vulnerabilities were due to a patch that addressed CVE-2024-21527, which could be...

CVE-2026-0558

creationtimestamp| type| source ---|---|--- 2026-03-29 18:33:36+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mi7rwhgj2f2e 2026-03-29 18:38:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi7sa2n63j2r 2026-03-29 19:15:55+00:00|...

CVE-2026-33875

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim users who click on a malicious deep link. Update...

Exploit for Path Traversal in Isaacs Tar

🛡️ CVE-2026-31802 - Simple Proof of Concept Viewer !Downloa...

CVE-2025-12886

creationtimestamp| type| source ---|---|--- 2026-03-28 04:50:08+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mi3th2xam522 2026-03-28 05:16:24+00:00| seen| Telegram/tmyQw9ecYEKCOGsqWYmG17zX-tnNmrFCLzChbU1VqxyCMY 2026-03-28 05:55:25+00:00| seen|...

PT-2026-32988

Hackage package metadata stored XSS vulnerability User-controlled metadata from .cabal files are rendered into HTML href attributes without proper sanitization, enabling stored Cross-Site Scripting XSS attacks. The specific fields affected are: - homepage - bug-reports - source-repository.locatio...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:1117-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:1117-1 advisory. Update to python 3.11.15: - CVE-2025-6075: quadratic complexity in os.path.expandvars bsc1252974. - CVE-2025-11468: header injectio...

CVE-2026-33976

creationtimestamp| type| source ---|---|--- 2026-03-27 22:00:30+00:00| seen| https://infosec.exchange/users/offseq/statuses/116303385663176446 2026-03-27 22:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mi34km6wmg2q 2026-03-27 22:18:31+00:00| seen|...