Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Summary Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the current IPv4 validation logic appears incomplete. The validatePublicUrl protection relies on isValidPublicIPv4Address to...

GHSA-42J2-W334-QXW7 Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of timeout configuration in the http.DefaultClient used for remote post-serve actions. An attacker can exhaust system memory and crash the process by registering a...

Hoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve Actions

Summary: Remote post-serve actions use http.DefaultClient without any timeout configuration. When the remote endpoint is unreachable or intentionally slow accepts TCP connection but never responds, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do. ...

CVE-2026-42990

creationtimestamp| type| source ---|---|--- 2026-07-14 17:58:46+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116919627031476451 2026-07-14 18:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmu6l7yux2z 2026-07-14 19:01:38+00:00| seen|...

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

CVE-2026-62656

The CVE-2026-62656 entry concerns post-authenticated command injection affecting certain NETGEAR RAX models. A logged-in user can send specially crafted requests to the router to run unauthorized commands, enabling changes to the router and impacting security/operation. The vulnerability targets ...

CVE-2026-62658

NETGEAR Nighthawk RAX series routers (RAX45, RAX43, RAX50, RAX54sv2) are affected by CVE-2026-62658, a post-authentication vulnerability that could allow a logged-in user to execute arbitrary commands or code on the device. The CVSS 4.0 base score is 5.7 (MEDIUM) with high integrity impact and ad...

CVE-2026-60081

creationtimestamp| type| source ---|---|--- 2026-07-14 17:06:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmowgjxe624...

CVE-2026-15392

creationtimestamp| type| source ---|---|--- 2026-07-14 16:56:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmoehb2hv24 2026-07-17 08:06:33+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mqtc6h73t72z 2026-07-17 08:06:52+00:00| seen|...

CVE-2026-58476

creationtimestamp| type| source ---|---|--- 2026-07-14 16:42:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmnn6ps442w 2026-07-22 05:00:05+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mr7k3mofxu2v...

CVE-2025-12012

creationtimestamp| type| source ---|---|--- 2026-07-14 16:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmmw4rlo42t 2026-07-16 16:15:45+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06 2026-07-22 04:55:00+00:00| seen|...

CVE-2025-12011

creationtimestamp| type| source ---|---|--- 2026-07-14 16:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmmw375fu2t 2026-07-16 16:15:43+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06...

CVE-2026-60114

creationtimestamp| type| source ---|---|--- 2026-07-14 16:03:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmlgnpvta2e 2026-07-17 11:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqtmbder3e2n 2026-07-22 04:56:06+00:00| seen|...

CVE-2026-58475

creationtimestamp| type| source ---|---|--- 2026-07-14 15:58:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqml5byefk2g...

CVE-2026-15736

creationtimestamp| type| source ---|---|--- 2026-07-14 15:51:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkrptyjv2l 2026-07-22 05:04:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kdanyfb2i...

CVE-2026-14903

creationtimestamp| type| source ---|---|--- 2026-07-14 15:49:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkoeal2u2x 2026-07-14 21:19:56+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-696 2026-07-22 05:10:33+00:00| seen|...

CVE-2026-14902

creationtimestamp| type| source ---|---|--- 2026-07-14 15:48:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkl6x6la25 2026-07-14 21:19:53+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-696...

CVE-2026-58477

creationtimestamp| type| source ---|---|--- 2026-07-14 15:46:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmki7bc3l2k 2026-07-15 06:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqo4ap2chw26 2026-07-15 06:37:07+00:00| seen|...

CVE-2026-10672

creationtimestamp| type| source ---|---|--- 2026-07-14 15:44:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkfemcwo2i 2026-07-20 18:00:05+00:00| seen| Telegram/wmuqBBYe-mnc2Lte0TuOGY6tvODW7j8bP7QungiPmYWc0w0 2026-07-21 00:00:33+00:00| seen|...