111155 matches found
CVE-2026-12041
creationtimestamp| type| source ---|---|--- 2026-07-08 05:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq4ehfuu5k2r 2026-07-08 08:01:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4npvpahf2e...
GHSA-9G8F-H8F3-HJCM
creationtimestamp| type| source ---|---|--- 2026-07-08 05:00:05+00:00| seen| https://bsky.app/profile/selfhost.directory/post/3mq4dkpqdgy2h...
CVE-2026-14244 Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter
The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...
CVE-2026-59997
creationtimestamp| type| source ---|---|--- 2026-07-08 04:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq4blvjx2p24 2026-07-08 22:47:27+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y 2026-07-10 12:03:35+00:00| seen|...
CVE-2026-59995
creationtimestamp| type| source ---|---|--- 2026-07-08 03:56:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq47zpcevu24 2026-07-08 22:47:27+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y 2026-07-10 04:02:17+00:00| seen|...
CVE-2026-55428
creationtimestamp| type| source ---|---|--- 2026-07-08 03:31:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq46mypl2d2k 2026-07-19 21:37:05+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqzqfomopm2v 2026-07-19 21:37:06+00:00| seen|...
CVE-2026-55077
creationtimestamp| type| source ---|---|--- 2026-07-08 00:59:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3w4fg6mc2x...
CVE-2026-55078
creationtimestamp| type| source ---|---|--- 2026-07-08 00:45:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3vcs3yad2x...
EUVD-2026-42106
mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollamabaseurl parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attack...
CVE-2026-55436
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy aibridgeproxyd created a goproxy server whose default transport set InsecureSkipVerify: true and only assigned a...
CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a...
CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...
CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...
EUVD-2026-42140
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...
CVE-2026-12277
creationtimestamp| type| source ---|---|--- 2026-07-08 00:00:21+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq3ssrwtoa2e 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-15 00:00:31+00:00|...
TP-Link Archer AX20 has a vulnerability related to input validation errors
The TP-Link Archer AX20 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer AX20 has a vulnerability related to input validation. This vulnerability stems from improper validation of URLs provided by users via the web interface. Attackers can exploit this...
PT-2026-56579
Name of the Vulnerable Software and Affected Versions Plate versions 53.0.0 through 53.1.3 Description The media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation. This allows a crafted document to specify a known video...
Linux Distros Unpatched Vulnerability : CVE-2026-58469
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that...
PT-2026-56516
Name of the Vulnerable Software and Affected Versions Astro version 6.4.7 Description Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional decodeURI operation, which can...