CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

CVE-2026-15964

creationtimestamp| type| source ---|---|--- 2026-08-01 10:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mrzb7mhn4f2c 2026-08-01 11:00:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzcugznah2n 2026-08-01 18:35:23+00:00| seen|...

CVE-2026-16635

creationtimestamp| type| source ---|---|--- 2026-08-01 09:56:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/66q5dtaf7v7nu 2026-08-01 11:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzcwrcpne2a 2026-08-01 17:34:50+00:00| seen|...

CVE-2026-15450

creationtimestamp| type| source ---|---|--- 2026-08-01 09:50:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dzh6iyuwq4bgt 2026-08-01 11:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrzcwxodbd2z...

CVE-2026-17346

creationtimestamp| type| source ---|---|--- 2026-08-01 09:37:05+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrz6a6dk422x 2026-08-01 09:37:06+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mrz6a6s6tm24 2026-08-02 08:00:28+00:00| seen|...

CVE-2026-51277

creationtimestamp| type| source ---|---|--- 2026-08-01 01:15:04+00:00| seen| https://gist.github.com/programmervuln/9c0274656cf88c341069fb99bf08ea6f 2026-08-01 01:16:31+00:00| seen| https://gist.github.com/programmervuln/4d53816d40d5dacd9cceefa2fe896598...

CVE-2026-18536: Cleartext Transmission of Sensitive Information

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

CVE-2026-53500

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

Regular Expression Denial of Service (ReDoS)

Overview thumbor is a thumbor is an open-source photo thumbnail service by globo.com Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the validate process. An attacker can access unauthorized external resources by supplying crafted hostnames that...

GHSA-6X26-6R6F-M537 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...

EUVD-2026-51597

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-53500

Thumbor (open-source image service by globo.com) is affected prior to version 7.8.0 where ALLOWED_SOURCES is applied by re.match() to unescaped strings, enabling a hostname with dot-position differences to bypass the allowlist. Root cause: unescaped patterns treated as normal strings in a regex m...

CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-53500 Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWEDSOURCES configuration passes plain strings to re.match without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0...

CVE-2026-67822

creationtimestamp| type| source ---|---|--- 2026-07-31 18:12:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5cbbr7n7dy7lz 2026-07-31 19:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxnh5mze42a 2026-08-08 23:28:21+00:00| seen|...

CVE-2026-17566

creationtimestamp| type| source ---|---|--- 2026-07-31 17:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxgkvuq372u 2026-07-31 17:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxgqkc5lt2i 2026-08-01 15:04:27+00:00| seen|...

CVE-2026-39448

creationtimestamp| type| source ---|---|--- 2026-07-31 10:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrwrj4bj7s2n 2026-07-31 11:00:06+00:00| seen| https://bsky.app/profile/potato.software/post/3mrwsfnlpr62c...