PT-2026-56268

Name of the Vulnerable Software and Affected Versions mem0 affected versions not specified Description Unauthenticated config API endpoints expose LLM API keys in plaintext and enable server-side request forgery SSRF, a technique where an attacker induces the server to make requests to an...

PT-2026-56305

Name of the Vulnerable Software and Affected Versions goploy version 1.17.5 Description An Insecure Direct Object Reference IDOR exists in the project and project-file handlers. The application fails to verify if a project or project-file belongs to the caller's namespace when processing requests...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Request Tracker vulnerabilities (USN-8506-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8506-1 advisory. Aleksander Iwicki discovered that Request Tracker did not properly sanitize the search Page URL parameter. A remote attacker coul...

PT-2026-56203

Name of the Vulnerable Software and Affected Versions Jastow affected versions not specified Description Jastow is susceptible to Cross-Site Scripting XSS, a flaw where malicious scripts are injected into trusted websites. This occurs due to improper input handling of unsanitized URIs when a...

PT-2026-56257

Name of the Vulnerable Software and Affected Versions LocalAI affected versions not specified Description An unauthenticated server-side request forgery SSRF exists in the 'POST /models/apply' endpoint. This occurs because the endpoint passes unsanitized gallery URL fields to the...

CVE-2026-12064

A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP SSH File Transfer Protocol or SCP Secure Copy Protocol as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect t...

GHSA-5493-9M76-2QRR

creationtimestamp| type| source ---|---|--- 2026-07-06 21:31:47+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpz22a66p72b...

CVE-2026-54760

creationtimestamp| type| source ---|---|--- 2026-07-06 21:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpyzx77jwz2l 2026-07-10 02:47:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqb534o76s2x...

CVE-2026-53486

creationtimestamp| type| source ---|---|--- 2026-07-06 21:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpyzx5z4fr2x 2026-07-12 13:01:36+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqhadhd3v72m 2026-07-14 23:28:46+00:00| seen|...

EUVD-2026-41212

Craft CMS: Sensitive File Disclosure / Server-Side File Read...

CVE-2026-55727

creationtimestamp| type| source ---|---|--- 2026-07-06 21:28:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpyzuzlayu2c...

CVE-2026-58404

Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and cloud-metadata IPv4 literals, but the deny rule only matched dotted-decimal notation, so alternate IPv4 encodings of the same addresses, including...

DEBIAN-CVE-2026-50134

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...

CVE-2026-41516

creationtimestamp| type| source ---|---|--- 2026-07-06 20:12:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyvmfdnjw26...

CVE-2026-57573

CVE-2026-57573 affects Crawl4AI: unauthenticated SSRF via the Docker stream endpoint. Before 0.9.0, SSRF checks were only on the non‑streaming /crawl path; handle_stream_crawl_request forwarded seed URLs with no destination validation. This allowed a remote, unauthenticated client to POST to /cra...

CVE-2026-42546

creationtimestamp| type| source ---|---|--- 2026-07-06 20:02:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyv2zsuzr2w...

CVE-2026-55646

creationtimestamp| type| source ---|---|--- 2026-07-06 19:57:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyuqutnll24 2026-07-09 15:03:14+00:00| seen| https://gist.github.com/Correctover/dcf89533dd8acf055791178f2130e704 2026-07-09 15:09:36+00:00| seen|...

CVE-2026-50133

creationtimestamp| type| source ---|---|--- 2026-07-06 19:55:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyunv5kaz2v...

CVE-2026-41515

creationtimestamp| type| source ---|---|--- 2026-07-06 19:53:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyul2ihh72b...

CVE-2026-50134 Hugo: security.http.urls allow-list bypass via HTTP redirects

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...