Regular Expression Denial of Service (ReDoS)

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the validate process. An attacker can access unauthorized external resources by supplying crafted hostnames that...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

GHSA-6X26-6R6F-M537 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

EUVD-2026-51597

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-53500

Thumbor (open-source image service by globo.com) is affected prior to version 7.8.0 where ALLOWED_SOURCES is applied by re.match() to unescaped strings, enabling a hostname with dot-position differences to bypass the allowlist. Root cause: unescaped patterns treated as normal strings in a regex m...

CVE-2026-67822

creationtimestamp| type| source ---|---|--- 2026-07-31 18:12:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5cbbr7n7dy7lz 2026-07-31 19:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxnh5mze42a 2026-08-08 23:28:21+00:00| seen|...

CVE-2026-17566

creationtimestamp| type| source ---|---|--- 2026-07-31 17:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxgkvuq372u 2026-07-31 17:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgqkc5lt2i 2026-08-01 15:04:27+00:00| seen|...

CVE-2026-39448

creationtimestamp| type| source ---|---|--- 2026-07-31 10:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrwrj4bj7s2n 2026-07-31 11:00:06+00:00| seen| https://bsky.app/profile/potato.software/post/3mrwsfnlpr62c...

CVE-2026-51247

creationtimestamp| type| source ---|---|--- 2026-07-31 06:40:55+00:00| seen| https://gist.github.com/programmervuln/d80518c782a43c1e4f07f22dbe4e04af 2026-07-31 06:42:22+00:00| seen| https://gist.github.com/programmervuln/bcc821b1a7ded9811e6996e0633b7e1c...

CVE-2026-51242

creationtimestamp| type| source ---|---|--- 2026-07-31 03:06:05+00:00| seen| https://gist.github.com/programmervuln/3795f1645c26047a1b358cb7159ceafc 2026-07-31 03:10:09+00:00| seen| https://gist.github.com/programmervuln/87b90903788d5ad7cfc29a83af254244 2026-07-31 03:45:05+00:00| seen|...

CVE-2026-14540: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...

CVE-2026-68502

creationtimestamp| type| source ---|---|--- 2026-07-30 22:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrvgudm3vn23 2026-07-30 22:04:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrvh244ih32q 2026-07-30 23:04:15+00:00| seen|...

GHSA-HF3J-86P7-MFW8

creationtimestamp| type| source ---|---|--- 2026-07-30 21:31:48+00:00| seen| https://gist.github.com/alon710/2558fd727c5d711082968032190a8577 2026-07-30 21:38:54+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mrvfmzyzxd23...

CVE-2026-61536

creationtimestamp| type| source ---|---|--- 2026-07-30 19:54:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ijlhn7uk5lbef 2026-07-30 20:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva5o4eg52q...

CVE-2026-18245

creationtimestamp| type| source ---|---|--- 2026-07-30 19:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv4y6hato2z 2026-07-30 19:04:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bovzhqup4waot 2026-07-30 20:01:52+00:00| seen|...

SUSE CVE-2026-27771

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information...

SUSE CVE-2026-29050

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file - for example through pull-request-driven CI or build-as-a-service scenarios - could set pipeline.uses to a...

SUSE CVE-2026-32885

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both Untar and Unzip functions in pkg/archive/archive.go. Downloads and extracts archives from remote sources without path validation. Version...