CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2024-1310

creationtimestamp| type| source ---|---|--- 2026-07-20 19:18:44+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3z57rhzd2j...

CVE-2026-63769

Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures,...

CVE-2026-63731

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

CVE-2026-55645

creationtimestamp| type| source ---|---|--- 2026-07-20 19:10:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3yoxhlpl23...

CVE-2026-63769

Huginn (up to version 2022.08.18) is affected by a server-side request forgery in the fetch_url method of ScenarioImport. The vulnerability allows authenticated users to submit crafted URLs that cause arbitrary HTTP requests, enabling probing of internal networks, port enumeration via error signa...

CVE-2026-58413

creationtimestamp| type| source ---|---|--- 2026-07-20 19:00:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3y52bqdc2o...

CVE-2026-58481

creationtimestamp| type| source ---|---|--- 2026-07-20 18:47:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3xfozvk223...

CVE-2026-58482

creationtimestamp| type| source ---|---|--- 2026-07-20 18:38:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3wvh2mgm24...

CVE-2026-64207

creationtimestamp| type| source ---|---|--- 2026-07-20 18:25:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3w6tyfla2i...

CVE-2026-63071

creationtimestamp| type| source ---|---|--- 2026-07-20 18:19:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr3vsp3r3u25 2026-07-21 15:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr64tc4amt22...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

GHSA-6JXM-FV7W-RW5J

creationtimestamp| type| source ---|---|--- 2026-07-20 18:00:49+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mr3urupfyo2u...

CVE-2026-21824

creationtimestamp| type| source ---|---|--- 2026-07-20 17:35:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3tej6ryt2o...

CVE-2026-44227

RT (Rocket Tickets) is affected in versions 6.0.0 and above up to, but not including, 6.0.3, where a reflected XSS vulnerability exists in URL parameters. An attacker who can lure an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user’s browser session, with...

CVE-2026-57356

creationtimestamp| type| source ---|---|--- 2026-07-20 16:44:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3qiss5gu2n 2026-07-21 02:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4rzmvp3q2j 2026-07-21 12:44:08+00:00| seen|...

CVE-2026-32824

The CVE affects dataCycle-CORE (dataCycle data management system). Before and including version 25.07.3, a low-privileged authenticated API user could supply forwardToUrl and redirectUrl during password reset/confirmation flows, which were embedded into outgoing emails without host allowlisting. ...

CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...