PYSEC-2026-809 Flask-Security vulnerable to Open Redirect

This affects all versions of package Flask-Security. When using the getpostlogoutredirect and getpostloginredirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only...

CVE-2026-57868

creationtimestamp| type| source ---|---|--- 2026-07-07 08:39:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq27ddn7ny2u...

CVE-2026-8309

creationtimestamp| type| source ---|---|--- 2026-07-07 08:24:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq26ii7rnj2b...

CVE-2026-57871

creationtimestamp| type| source ---|---|--- 2026-07-07 08:02:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq25c7qnkf2a...

CVE-2026-5730

creationtimestamp| type| source ---|---|--- 2026-07-07 07:59:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq254tqfsn2a...

CVE-2026-34198

creationtimestamp| type| source ---|---|--- 2026-07-07 04:26:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzr7cexwq2y...

CVE-2026-34171

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/uuid endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit...

CVE-2026-42200

creationtimestamp| type| source ---|---|--- 2026-07-07 03:58:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzpnah5yk2y 2026-07-07 06:01:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpzwj4t67o25...

CVE-2026-34170 Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

EUVD-2026-41997

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp apiurl field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowing an authenticated user to configure a...

CVE-2026-34171

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/uuid endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit...

SUSE CVE-2026-13983

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Medium...

GHSA-4HF7-XXXW-64RM

creationtimestamp| type| source ---|---|--- 2026-07-07 02:04:20+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpzjbl2rdb22...

CVE-2026-59710

creationtimestamp| type| source ---|---|--- 2026-07-07 00:49:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzf3cbl6q2w...

CVE-2026-53640

creationtimestamp| type| source ---|---|--- 2026-07-07 00:44:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpzesdsdgl2c...

GHSA-V5WF-J8J4-77H7

creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:44+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgei5er2s...

GHSA-RQ8F-9XJH-PR3M

creationtimestamp| type| source ---|---|--- 2026-07-07 00:01:44+00:00| seen| https://bsky.app/profile/slackers.it/post/3mpzcgei5er2s...

PT-2026-56268

Name of the Vulnerable Software and Affected Versions mem0 affected versions not specified Description Unauthenticated config API endpoints expose LLM API keys in plaintext and enable server-side request forgery SSRF, a technique where an attacker induces the server to make requests to an...

PT-2026-56305

Name of the Vulnerable Software and Affected Versions goploy version 1.17.5 Description An Insecure Direct Object Reference IDOR exists in the project and project-file handlers. The application fails to verify if a project or project-file belongs to the caller's namespace when processing requests...

PT-2026-56203

Name of the Vulnerable Software and Affected Versions Jastow affected versions not specified Description Jastow is susceptible to Cross-Site Scripting XSS, a flaw where malicious scripts are injected into trusted websites. This occurs due to improper input handling of unsanitized URIs when a...