41028 matches found
CVE-2026-11820
A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API credentials apikey and apisecret into URL query parameters and sending them via GET requests. This causes credentials to be exposed in web...
CVE-2020-35674
creationtimestamp| type| source ---|---|--- 2026-06-23 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moy5l6t2rq2j...
CVE-2026-53753
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT...
CVE-2026-53753
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT...
EUVD-2026-38569
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT...
CVE-2026-12957
creationtimestamp| type| source ---|---|--- 2026-06-23 17:54:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxxui6sh62t 2026-06-25 14:56:43+00:00| seen| https://bsky.app/profile/eyalestrin.bsky.social/post/3mp4otnuzjr2v 2026-06-26 14:34:55+00:00| seen|...
CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView homeassistant/components/konnected/init.py, that is marked as not requiring authentication requiresauth = False....
GHSA-89MR-XQFV-758M Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
Summary Repository.UploadRepoFiles checks for symlinks only on the leaf of the upload target osx.IsSymlinktargetPath. The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component — UploadRepoFiles is the lone outlier. An attacker with repo-wri...
CVE-2026-54007
CVE-2026-54007 describes a cross-origin postMessage bypass in Open WebUI prior to version 0.9.6. The root cause is a chat input/submit flow in the Chat.svelte window message listener that accepts non-same-origin messages (input:prompt and action:submit) and forwards them to submitPrompt(), enabli...
CVE-2026-54007 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...
CVE-2026-54007 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...
CVE-2026-50221
creationtimestamp| type| source ---|---|--- 2026-06-23 16:29:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3moxt4m72zm2s 2026-06-29 23:53:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphop63u4q2q...
CVE-2026-35018
creationtimestamp| type| source ---|---|--- 2026-06-23 16:21:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxsmyk3dz2q...
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration
President Trump signed an executive order on June 22 setting hard deadlines for federal agencies to move high-value assets and high-impact systems to post-quantum cryptography. Key establishment must move by December 31, 2030; digital signatures by December 31, 2031. EO 14409 leaves national...
CVE-2025-71370
creationtimestamp| type| source ---|---|--- 2026-06-23 14:42:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxn3phlth2q...
CVE-2026-56274
creationtimestamp| type| source ---|---|--- 2026-06-23 14:27:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxmasquup2a 2026-06-25 05:40:10+00:00| seen| https://gist.github.com/muhamedfazalps/db2c0e46436e75ee35dd214e14e27b40 2026-07-10 11:37:06+00:00| seen|...
CVE-2026-56243
creationtimestamp| type| source ---|---|--- 2026-06-23 14:22:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlz54mb62o...
CVE-2026-56315
creationtimestamp| type| source ---|---|--- 2026-06-23 14:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxlh2kytx2w...