111818 matches found
CVE-2026-59095 LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service importFromUrl and topic cover update fetchImageFromUrl...
CVE-2026-58578
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...
Security Bulletin: SSRF Protection Configuration Vulnerability
Summary A configuration vulnerability was identified where SSRF Server-Side Request Forgery protection could be disabled through default settings, potentially allowing authenticated users to make the server fetch arbitrary URLs including cloud metadata endpoints 169.254.169.254, internal services...
GHSA-8882-FRVV-92W4 @asymmetric-effort/specifyjs: URL parse failure silently allows request
Finding Location: core/src/shared/secure-fetch.ts:42-45 When new URL throws a parse error, the assertSecureUrl function returned without throwing, silently allowing the request to proceed without HTTPS validation. Status Fixed in v0.2.136 — The catch block now throws an error instead of silently...
CVE-2026-55110
creationtimestamp| type| source ---|---|--- 2026-07-02 18:51:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpop7glvx22w 2026-07-03 07:07:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppydky5l42i 2026-07-08 11:01:21+00:00| seen|...
CVE-2026-50746
creationtimestamp| type| source ---|---|--- 2026-07-02 18:21:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mponk2wkp327 2026-07-03 21:35:47+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mpriumewrl2b 2026-07-07 13:30:26+00:00| seen|...
CVE-2025-58902
creationtimestamp| type| source ---|---|--- 2026-07-02 17:05:07+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpojbp3e6w2v 2026-07-03 03:26:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpplzmqmgt2k 2026-07-03 11:39:39+00:00| seen|...
CVE-2026-57760
creationtimestamp| type| source ---|---|--- 2026-07-02 16:04:20+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpofuyuxxe24 2026-07-03 00:46:29+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppd2oktjy2i 2026-07-03 03:53:14+00:00| seen|...
CVE-2026-8079
creationtimestamp| type| source ---|---|--- 2026-07-02 15:21:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpodiemxpv26 2026-07-03 07:25:07+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppzdjgcdz26 2026-07-03 09:37:20+00:00| seen|...
CVE-2026-36909
creationtimestamp| type| source ---|---|--- 2026-07-02 14:30:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoanicpv22q 2026-07-03 09:21:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq7tp5mhs2y...
CVE-2026-55793
creationtimestamp| type| source ---|---|--- 2026-07-02 14:29:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaley52l2b 2026-07-06 22:35:07+00:00| published-proof-of-concept| https://github.com/craftcms/cms/security/advisories/GHSA-xrqc-p465-2xvg 2026-07-07 01:42:10+00:00|...
CVE-2026-54262
creationtimestamp| type| source ---|---|--- 2026-07-02 14:28:11+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaj35qfl27 2026-07-03 13:26:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnk6jp5n2c...
CVE-2026-54260
creationtimestamp| type| source ---|---|--- 2026-07-02 14:26:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoafqta2k2q 2026-07-03 13:26:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqnj7hxnt2y...
CVE-2026-36911
creationtimestamp| type| source ---|---|--- 2026-07-02 14:23:36+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoaauvk6h2r 2026-07-03 09:22:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq7vrw7en2m...
CVE-2026-36910
creationtimestamp| type| source ---|---|--- 2026-07-02 14:20:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpoa425kkt2d 2026-07-03 09:22:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpq7v6adfc2j...
CVE-2026-13251
creationtimestamp| type| source ---|---|--- 2026-07-02 14:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpo7rpkclv27 2026-07-02 22:22:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp2yymfoc2o 2026-07-02 22:22:22+00:00| seen|...
PYSEC-2026-659 mailman Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...
PYSEC-2026-632 Cross-site scripting vulnerability in TinyMCE plugins
Impact A cross-site scripting XSS vulnerability was discovered in the URL processing logic of the image and link plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the...
PYSEC-2026-647 Open Redirect vulnerability in jupyterhub and notebook
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers Chrome, Firefox in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a baseurl prefix are not affecte...