CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

CVE-2026-73263 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...

CVE-2026-73263 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfigcontent containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfigcontainsexecauth in api/src/backend/api/v1/serializers.py checked only exec...

CVE-2026-73077

creationtimestamp| type| source ---|---|--- 2026-08-12 13:45:52+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-vim-1...

CVE-2026-70467

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

CVE-2026-70467

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

CVE-2026-70467

Fortinet FortiSIEM is affected by a server-side request forgery (SSRF) vulnerability across multiple versions: 7.5.0; 7.4.x (7.4.0–7.4.2); 7.3.x (7.3.0–7.3.5); and all releases of 7.2, 7.1, 7.0, 6.7, 6.6, and 6.5. The issue may allow an attacker to execute unauthorized code or commands via an att...

EUVD-2026-57190

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

Exploit for CVE-2026-64638

Require...

CVE-2026-11325

The CVE-2026-11325 entry concerns Cloudflare’s cloudflare/pages-action, an archived repository deprecated since 2024. A remote code execution vulnerability was reported in src/index.ts that could be reachable via certain GitHub Actions workflow configurations, potentially exposing workflow secret...

EUVD-2026-57178

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

CVE-2026-11325 cloudflare/pages-action is deprecated — migration required by September 18th, 2026

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

CVE-2026-11325

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

WordPress Car Rental Manager plugin <= 1.3.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Phat RiO in WordPress Plugin Car Rental Manager versions = 1.3.9...

Malicious code in vfgnhlkxchrd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8d278c0d7ee5dd3f8e12e924051d7e4d77afc4e12b408e6cb1e089071fde5ec [email protected] contains a single HTML file referenced as the package main that mimics a Cloudflare 'Just a moment...' challenge. Embedded...

MAL-2026-13800 Malicious code in cvvkshuelwiu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3f325329894b841474989d30370570a7f1b68d02334db1b98dcaf109899fa9 Package [email protected] contains 2 files with no a static rule matches and no traced behaviors of concern. No install-time scripts, network...

Malicious code in mnzjgxciwadk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb5ec6b21fbd7d0b720bf6dd7257a5b6e0e9428fe55d8197fccec53c79a662 The package contains a single file, index.html, which is also declared as the package main. The HTML presents a Cloudflare Turnstile-styled challenge...

MAL-2026-13799 Malicious code in cvmbxcjiasdg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 925628ce795fdbf222c292ae4ccfbe710eda2fa1b6fd521db3379f9569e16f9b The package contains a single index.html file declared as main and no JavaScript entry point, lifecycle scripts preinstall/install/postinstall/prepar...

Malicious code in cvbniydplwe3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9edbef37139b40a366aacea90abbd4b80ca581921f213b98ffb17db3b857bfcd The tarball contains only index.html declared as package.json main and no JavaScript, no lifecycle scripts, and no Node-executable entry point...