CVE-2026-41515

creationtimestamp| type| source ---|---|--- 2026-07-06 19:53:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyul2ihh72b...

CVE-2026-50134 Hugo: security.http.urls allow-list bypass via HTTP redirects

Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did not re-validate intermediate URLs on HTTP 3xx redirects. An allowed server or an attacker controlling its DNS or response could therefore redirect t...

CVE-2026-35339

creationtimestamp| type| source ---|---|--- 2026-07-06 19:41:46+00:00| seen| https://gist.github.com/alon710/194b323308c6542ff0a22bb475e2c02f...

CVE-2026-14898

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image U...

EUVD-2026-41915

The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An attacker who could place an indirect prompt injection in content processed by Codex, such as a connected-tool result or another untrusted source, could induce the model to construct a remote image U...

CVE-2026-24012

creationtimestamp| type| source ---|---|--- 2026-07-06 19:14:38+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mpyseyhbm32c...

CVE-2026-40140

creationtimestamp| type| source ---|---|--- 2026-07-06 17:22:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpym3v2pgs22 2026-07-06 17:48:42+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpynkx35vt2f 2026-07-07 12:25:11+00:00| seen|...

CVE-2026-57640

creationtimestamp| type| source ---|---|--- 2026-07-06 17:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpylpcbfij2n...

CVE-2025-15668

creationtimestamp| type| source ---|---|--- 2026-07-06 16:50:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpykcrz2ok2z...

CVE-2026-59152

creationtimestamp| type| source ---|---|--- 2026-07-06 16:30:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyj6ybouc2b...

CVE-2025-53827

creationtimestamp| type| source ---|---|--- 2026-07-06 16:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhmrqo542c 2026-07-06 17:24:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpym7ct5ri23...

CVE-2026-5268

creationtimestamp| type| source ---|---|--- 2026-07-06 15:57:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpyhdrykfp22 2026-07-06 19:26:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpyszhqb762x...

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

EUVD-2026-41876

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

CVE-2026-54893

Swoosh.Adapters.MsGraph is vulnerable to URL path injection via the from-address interpolation into /users/{from}/sendMail without percent-encoding or validation. If from derives from untrusted input, an attacker can inject URL-special characters (/, ?, #) to escape the intended path and rewrite ...

CVE-2026-54291

creationtimestamp| type| source ---|---|--- 2026-07-06 13:50:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpyaapk5fs2o 2026-07-06 20:36:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpywxzrvi324 2026-07-19 22:07:08+00:00| seen|...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-4249

creationtimestamp| type| source ---|---|--- 2026-07-06 12:22:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpy3dicdxy2n 2026-07-13 00:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqifjigmk42f...