111998 matches found
GO-2026-5480 Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer
Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...
GO-2026-5436 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave...
Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this...
CVE-2026-6330
creationtimestamp| type| source ---|---|--- 2026-06-25 22:25:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hvwozge27...
CVE-2026-11800
creationtimestamp| type| source ---|---|--- 2026-06-25 22:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hhhr7qa2r 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:32+00:00| seen|...
Server-side Request Forgery (SSRF)
Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the improper handling of user-supplied URLs in the acmeurl parameter, lack of access control in the certificate key-fetch process, and...
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via...
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
Summary When verifying an uploaded certificate, lemur/certificates/verify.py extracts the CRL Distribution Point URL and the OCSP responder URL directly from the certificate's extensions and issues outbound requests to those URLs without scheme restriction or destination allow-listing. An...
CVE-2026-6092
creationtimestamp| type| source ---|---|--- 2026-06-25 21:55:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5galeomc27...
CVE-2026-6325
creationtimestamp| type| source ---|---|--- 2026-06-25 21:53:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5g5lm4ac2w...
CVE-2017-14876
creationtimestamp| type| source ---|---|--- 2026-06-25 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp56j2cdy62r...
CVE-2026-56771
NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...
CVE-2017-16614
creationtimestamp| type| source ---|---|--- 2026-06-25 19:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp54tesowb2n...
GO-2026-5310 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp...
GO-2026-5351 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno
Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno...
GO-2026-5294 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) in github.com/juev/nebula-mesh
nebula-mesh: Newly-minted operator API key exposed in redirect URL Referer, history, proxy logs in github.com/juev/nebula-mesh...
CVE-2017-17766
creationtimestamp| type| source ---|---|--- 2026-06-25 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp535qfbmo2e...
GO-2026-5108 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall...
GO-2026-5141 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel
Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel...