111113 matches found
CVE-2026-54443
creationtimestamp| type| source ---|---|--- 2026-07-15 20:50:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqplwy7au72x...
CVE-2026-45534
creationtimestamp| type| source ---|---|--- 2026-07-15 20:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqplsdyn722c 2026-07-16 00:43:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpyxxtwrc2e...
CVE-2026-45738
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...
CVE-2026-20156
creationtimestamp| type| source ---|---|--- 2026-07-15 19:39:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphydbcrh2h 2026-07-16 00:22:54+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116926799807904548 2026-07-16 13:00:30+00:00| seen|...
CVE-2026-40501
creationtimestamp| type| source ---|---|--- 2026-07-15 19:30:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphhoez2b2u...
CVE-2026-49987
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection th...
CVE-2026-20296
creationtimestamp| type| source ---|---|--- 2026-07-15 19:10:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgdzh2ib22 2026-07-16 02:11:53+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqq5vdvydd2i 2026-07-16 06:26:56+00:00| seen|...
Use of Non-Canonical URL Paths for Authorization Decisions
Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...
Use of Non-Canonical URL Paths for Authorization Decisions
Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...
Use of Non-Canonical URL Paths for Authorization Decisions
Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...
Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4
Summary Koel's outbound-URL guard App\Helpers\Network::isPublicHost classifies an IP as "public" using PHP's filtervar$ip, FILTERVALIDATEIP, FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-local IPv4:...
CVE-2026-49987
Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection th...
CVE-2026-54563
creationtimestamp| type| source ---|---|--- 2026-07-15 17:17:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp7zq7njw22...
GHSA-6P96-CFG5-4VHP Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Summary Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel's radio streaming feature to make the server...
Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations
Summary Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel's radio streaming feature to make the server...
GHSA-W79M-F3JX-779V Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation
Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...
CVE-2026-62175
creationtimestamp| type| source ---|---|--- 2026-07-15 16:35:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp5pcy7rq2s...
CVE-2026-61433
creationtimestamp| type| source ---|---|--- 2026-07-15 16:01:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp3rzyupx2e...