CVE-2026-6092

creationtimestamp| type| source ---|---|--- 2026-06-25 21:55:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5galeomc27...

CVE-2026-6325

creationtimestamp| type| source ---|---|--- 2026-06-25 21:53:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5g5lm4ac2w...

CVE-2017-14876

creationtimestamp| type| source ---|---|--- 2026-06-25 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp56j2cdy62r...

CVE-2026-56771

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the addurl endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and...

CVE-2017-16614

creationtimestamp| type| source ---|---|--- 2026-06-25 19:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp54tesowb2n...

GO-2026-5310 Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp

Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server in github.com/apache/skywalking-mcp...

GO-2026-5351 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno

Kyverno: ServiceAccount token leaked to external servers via apiCall service URL in github.com/kyverno/kyverno...

GO-2026-5294 nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs) in github.com/juev/nebula-mesh

nebula-mesh: Newly-minted operator API key exposed in redirect URL Referer, history, proxy logs in github.com/juev/nebula-mesh...

CVE-2017-17766

creationtimestamp| type| source ---|---|--- 2026-06-25 18:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp535qfbmo2e...

GO-2026-5108 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall...

GO-2026-5141 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel

Beszel has an IDOR in hub API endpoints that read system ID from URL parameter in github.com/henrygd/beszel...

CVE-2026-6091

creationtimestamp| type| source ---|---|--- 2026-06-25 18:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zzxq2wn2f...

CVE-2026-9179

creationtimestamp| type| source ---|---|--- 2026-06-25 18:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4zy7pl6f2w...

CVE-2026-55697

creationtimestamp| type| source ---|---|--- 2026-06-25 18:13:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4ztxnb3j2o 2026-06-27 00:35:14+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-gj8w-mvpf-x27x...

CVE-2026-56779

MaxKB

EUVD-2026-39527

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56779

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-55700

creationtimestamp| type| source ---|---|--- 2026-06-25 18:08:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zjp5xqs2o 2026-06-27 07:12:30+00:00| seen| https://gist.github.com/alon710/df5b0744014030db937f68dddaa36b9f 2026-06-29 23:02:40+00:00| seen|...