CVE-2026-54572

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...

CVE-2026-54572 rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an...

CVE-2026-61520

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the pro...

UBUNTU-CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...

CVE-2026-48801

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has ON² algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs...

CVE-2026-61520

The CVE-2026-61520 entry documents a server-side request forgery in Simple Machines Forum (SMF) image proxy. Affected versions are SMF 2.1 prior to commit 4bf35cf and SMF 3.0 prior to commit b4d23df. The vulnerability allows authenticated attackers to trigger internal HTTP requests by embedding a...

CVE-2026-45064

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...

CVE-2026-50501

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:50+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:39+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:29+00:00| seen|...

CVE-2026-50350

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:08+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:54+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:01+00:00| seen|...

CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...

CVE-2026-45753

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...

CVE-2026-62643

A flaw was found in Roundcube Webmail. Insufficient sanitization of Cascading Style Sheets CSS within HTML email messages allows a remote attacker to perform Server-Side Request Forgery SSRF or disclose sensitive information. This vulnerability occurs when stylesheet links point to local network...

DEBIAN-CVE-2026-62643

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for...

CVE-2026-62643

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for...

CVE-2026-62643

CVE-2026-62643 affects Roundcube Webmail prior to 1.6.17 and 1.7.x prior to 1.7.2. The issue is insufficient CSS sanitization in HTML email bodies, which can enable SSRF or information disclosure when stylesheet links point to local network hosts. Public disclosures and advisories in connected do...

CVE-2026-62643

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for...

Telegram’s t.me Links Go Offline After Registry Places Domain on serverHold

Telegram's t.me links stopped resolving after the .ME registry applied serverHold. The app still works, while the reason for the domain action remains unknown...

CVE-2026-56451

creationtimestamp| type| source ---|---|--- 2026-07-14 10:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116917864212446754 2026-07-14 10:30:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqlyt42e3r2x 2026-07-14 10:42:07+00:00| seen|...

CVE-2026-57898

creationtimestamp| type| source ---|---|--- 2026-07-14 08:38:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlsk4d6bi2g 2026-07-14 08:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqlsnns7tw2b 2026-07-14 09:00:32+00:00| seen|...

CVE-2026-6851

An Improper link resolution before file access 'link following' vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue...