GHSA-6964-PP88-6WP9 Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

Summary The executeQuery automation step in Budibase accepts a queryId from automation step inputs and passes it directly to the query execution controller without additional validation. When combined with a REST datasource configured to target internal infrastructure, this creates a server-side...

CVE-2026-44206

Frappe (full-stack web application framework) contains CVE-2026-44206, where DB Schema Enumeration is possible via a vulnerable endpoint prior to versions 15.107.2 and 16.17.4. The issue has been patched in those versions. The CVSS 4.0 base score is 6.9 (MEDIUM) with network attack vector, low co...

CVE-2026-44206 Frappe: DB Schema Enumeration via Frappe-Authorization-Source

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...

CVE-2026-44206 Frappe: DB Schema Enumeration via Frappe-Authorization-Source

Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, DB Schema Enumeration is possible through exploiting an endpoint. This issue has been patched in versions 15.107.2 and 16.17.4...

sbom-risk-analyzer

SBOM-Risk-Analyzer Exploitability-weighted vulnerability pri...

CVE-2026-49993

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack /...

CVE-2026-45670

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack /...

EUVD-2026-36447

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.4...

CVE-2026-45673 Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entrop...

CVE-2017-20240

creationtimestamp| type| source ---|---|--- 2026-06-12 14:15:26+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mo3whv6i542r...

CVE-2026-47196

creationtimestamp| type| source ---|---|--- 2026-06-12 13:57:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3vgwapyy23...

CVE-2026-47195

creationtimestamp| type| source ---|---|--- 2026-06-12 13:52:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3v5xts342j...

CVE-2026-48485

creationtimestamp| type| source ---|---|--- 2026-06-12 13:41:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3um2z5le2f...

CVE-2026-49993 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0 to before 4.4.7, there is an incomplete fix for GHSA-6m52-m754-pw2g. Source code may still be stolen during dev when using the webpack /...

CVE-2026-49993

Nuxt (Vue.js) users using the @nuxt/rspack-builder and @nuxt/webpack-builder are affected. The CVE concerns an incomplete fix for GHSA-6m52-m754-pw2g in versions 3.15.4–3.21.6 and 4.0.0–4.4.6, where the dev server could leak source code if bound to a non-loopback address and a malicious site is o...

CVE-2026-41708

creationtimestamp| type| source ---|---|--- 2026-06-12 12:55:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3rytodm42d 2026-06-15 20:13:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe3ve7spj2y...

CVE-2026-47825

creationtimestamp| type| source ---|---|--- 2026-06-12 12:55:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mo3rytodm42d...

CVE-2026-45670 Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6, there is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during dev when using the webpack /...

CVE-2026-50012

creationtimestamp| type| source ---|---|--- 2026-06-12 12:48:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mo3rm3en6x2v 2026-06-15 14:19:30+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3modi3vazfl2z 2026-06-15 23:59:01+00:00| seen|...

CVE-2026-47729

creationtimestamp| type| source ---|---|--- 2026-06-12 12:48:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mo3rm3en6x2v 2026-06-15 14:19:29+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3modi3vazfl2z 2026-06-15 23:59:01+00:00| seen|...