PT-2026-127737

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP sendreq new and OCSP parse url functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Informati...

CLSA-2026-1791841669 TuxCare security update for parse-url (2 CVEs)

TuxCare rebuilt parse-url to address 2 CVEs. Fixed in 6.0.5-tuxcare.1...

PT-2026-121717

TuxCare rebuilt parse-url to address 2 CVEs. Fixed in 6.0.5-tuxcare.1...

PT-2026-96128

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Deserialization of untrusted data occurs within the cn parse url function. A remote attacker can inject arbitrary values into internal request variables, such as referer, by submitting a crafted base64-encode...

CVE-2026-72777

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-72777

Next AI Draw.io

CVE-2026-72777 Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-72777: Server-Side Request Forgery (SSRF)

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

PHPSpreadsheet has a patch bypass for CVE-2026-34084

Summary CVE-2026-34084 was patched by the helper File::prohibitWrappers. The helper calls parseurl$filename, PHPURLSCHEME and then checks isstring$scheme && strlen$scheme 1 to reject stream wrappers such as phar://, php://, data:// or expect://. The check is not equivalent to "does the path conta...

WS-2022-0239

Cross-Site Scripting via Improper Input Validation parser differential in parse-url before 8.0.0. Through this vulnerability, an attacker is capable to execute malicious JS codes...

10secondsofcode-custom (1.0.0), 1kohei1 (>=1.0.0, <=1.0.1) +4771 more potentially affected by unknown CVE via parse-url (>=1.0.0, <=7.0.2)

parse-url NPM version =1.0.0, =1.0.0, =1.0.0, =3.0.0-beta.22, =3.0.0-beta.22, =3.16.2, =3.16.3, =3.16.2, =3.16.2, =0.1.2, =0.1.8 and more Source cves: unknown CVE Source advisory: MEND:WS-2022-0239...

WS-2022-0238

File Protocol Spoofing in parse-url before 8.0.0 can lead to attacks, such as XSS, Arbitrary Read/Write File, and Remote Code Execution...

10secondsofcode-custom (1.0.0), 1kohei1 (>=1.0.0, <=1.0.1) +4771 more potentially affected by unknown CVE via parse-url (>=1.0.0, <=7.0.2)

parse-url NPM version =1.0.0, =1.0.0, =1.0.0, =3.0.0-beta.22, =3.0.0-beta.22, =3.16.2, =3.16.3, =3.16.2, =3.16.2, =0.1.2, =0.1.8 and more Source cves: unknown CVE Source advisory: MEND:WS-2022-0238...

WS-2022-0237

Regular Expression Denial of Service ReDoS in ionicabizau/parse-url before 8.0.0. It allows cause a denial of service when calling function parse-url...

10secondsofcode-custom (1.0.0), 1kohei1 (>=1.0.0, <=1.0.1) +4771 more potentially affected by unknown CVE via parse-url (>=1.0.0, <=7.0.2)

parse-url NPM version =1.0.0, =1.0.0, =1.0.0, =3.0.0-beta.22, =3.0.0-beta.22, =3.16.2, =3.16.3, =3.16.2, =3.16.2, =0.1.2, =0.1.8 and more Source cves: unknown CVE Source advisory: MEND:WS-2022-0237...

phpMyFAQ Cross-Site Script Vulnerabilities

phpMyFAQ is a multilingual, database-driven FAQ system developed by Thorsten Rinne. Versions of phpMyFAQ prior to 4.1.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the Utils::parseUrl function, which allowed authenticated users to inject JavaScript through...

Improper Encoding or Escaping of Output

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the Utils::parseUrl function during comment rendering. An attacker can execute arbitrary JavaScript in the...

CVE-2026-6141

A vulnerability was determined in danielmiessler PersonalAIInfrastructure up to 2.3.0. Affected is an unknown function of the file Skills/Parser/Tools/parseurl.ts. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been publicly disclos...