CVE-2026-24248

creationtimestamp| type| source ---|---|--- 2026-07-01 16:35:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplx6mxczo2p 2026-07-02 04:34:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7downsd2l...

CVE-2026-58025

creationtimestamp| type| source ---|---|--- 2026-07-01 16:26:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplwmq2mzg2y 2026-07-02 02:49:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzi6sza72o 2026-07-02 04:32:41+00:00| seen|...

EUVD-2026-41061

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php line 124: SELECT FROM complex WHERE name='".$GET'name'."'. An authenticated attacker can perform error-based SQL injection to extract database contents...

CVE-2026-34098

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action attributes in media.php lines 119, 129. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-34097

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attributes in textfile.php lines 94, 101, 323, 403, 826, 852. An authenticated attacker can craft a URL that injects script tags executing in the victim's browser session...

CVE-2026-24247

creationtimestamp| type| source ---|---|--- 2026-07-01 16:01:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplvbnh36e2i 2026-07-02 04:34:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpn7d2yb3a2o...

CVE-2026-6678

creationtimestamp| type| source ---|---|--- 2026-07-01 16:00:12+00:00| seen| https://infosec.place/objects/cf6e553c-bb60-4c89-9f17-6f2b54a2754a...

CVE-2026-58028

creationtimestamp| type| source ---|---|--- 2026-07-01 15:52:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mplurpetfu26 2026-07-02 02:51:15+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmzkujtyx27 2026-07-02 04:35:02+00:00| seen|...

CVE-2026-34993

creationtimestamp| type| source ---|---|--- 2026-07-01 15:13:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplslnu2cj2t 2026-07-03 00:08:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mppaxkjiaf2c...

EUVD-2026-41032

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php...

CVE-2026-13706 UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php...

CVE-2026-13706 UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php...

CVE-2026-13706

The CVE-2026-13706 entry concerns Wikimedia Foundation UrlShortener with an improper input validation issue in the UrlShortenerUtils.Php component. According to the NVD entry, the flaw yields a HIGH-severity impact across confidentiality, integrity, and availability (C:H/I:H/A:H) with network att...

Uncaught Exception

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Uncaught Exception in the URL normalization process when handling malformed percent-encoded sequences in incoming request paths. An attacker can cause the Node.js process to terminate...

CVE-2026-13603

CVE-2026-13603 affects the pretix-oppwa payment integration. The vulnerability arises from insecure handling of Oppwa’s API URL: the code concatenated resourcePath from the return URL to baseUrl without validation and without a trailing slash, enabling an attacker to redirect the API call to a di...

CVE-2026-13603 SSRF with API key leak in pretix-oppwa

The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the payment provider back to o...

CVE-2026-12113

creationtimestamp| type| source ---|---|--- 2026-07-01 12:47:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplkfu34ao23...

CVE-2026-20457

creationtimestamp| type| source ---|---|--- 2026-07-01 12:40:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mplk23bz3w23 2026-07-02 06:21:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnfc7ovxy2i 2026-07-07 16:45:07+00:00| seen|...

CVE-2026-1239

creationtimestamp| type| source ---|---|--- 2026-07-01 12:11:45+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mplig3lr5o27...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...