CVE-2026-40089

Sonicverse (Self-hosted Docker Compose stack) contains an SSRF in the dashboard API client (apps/dashboard/lib/api.ts). User-controlled URLs are passed from the dashboard to a server-side HTTP client without sufficient validation, allowing an authenticated operator to trigger arbitrary HTTP reque...

CVE-2026-27728

creationtimestamp| type| source ---|---|--- 2026-02-23 13:00:06+00:00| published-proof-of-concept| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-jmhp-5558-qxh5 2026-02-25 17:40:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mfp7zft2r22h 2026-02-25...

CVE-2025-4645

creationtimestamp| type| source ---|---|--- 2025-11-11 07:19:33+00:00| seen| https://bsky.app/profile/potato.software/post/3m5dlw3ivic2h 2025-11-11 07:30:26+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5dmj7iym762 2025-11-11 10:03:23+00:00| seen|...

CVE-2025-41001

creationtimestamp| type| source ---|---|--- 2025-11-10 12:11:09+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5blpcso4cw2 2025-11-10 13:33:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5bqe7tluc2s...

pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools

A flaw was found in the packageindex module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to co...

pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools

A flaw was found in the packageindex module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to co...

Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex

There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. Impact If you render an tag with an href attribute set to a user-provided link, that...