CVE-2026-50131

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

Server-side Request Forgery (SSRF)

Overview @fedify/vocab-runtime is a Runtime library for code-generated Activity Vocabulary APIs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the validatePublicUrl process. An attacker can access internal or otherwise restricted network resources by...

Server-side Request Forgery (SSRF)

Overview @fedify/fedify is an An ActivityPub server framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the validatePublicUrl process. An attacker can access internal or otherwise restricted network resources by supplying specially crafted URLs that...

GHSA-9PG3-25FQ-P6CC nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

internal/web/operators.go:251 — after handleOperatorCreateAPIKey mints a fresh 32-byte bearer token, the redirect points the operator's browser at: /ui/operators/?newkey=&keyname= The raw API key ends up: - in the browser's URL history - in the Referer header on every cross-origin asset the detai...

CVE-2026-28301

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website...

CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

CVE-2026-11417

creationtimestamp| type| source ---|---|--- 2026-06-10 20:21:33+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mnxjynboly2i 2026-06-13 19:00:11+00:00| published-proof-of-concept| Telegram/UUlhUbRH-lM0c2HkqQnuE7VUmZM0B1Eg2dBpWy1dBuIGV4 2026-06-13 21:00:04+00:00|...

CVE-2026-47946

creationtimestamp| type| source ---|---|--- 2026-06-10 20:04:27+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mnxj25bawp22...

CVE-2026-50564

creationtimestamp| type| source ---|---|--- 2026-06-10 19:22:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxgpf7ogi25 2026-07-01 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116842838632410584 2026-07-01 04:30:31+00:00| seen|...

CVE-2026-49823

creationtimestamp| type| source ---|---|--- 2026-06-10 19:19:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxgkin2lm2i 2026-06-11 09:04:32+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnyumzfwqu27...

CVE-2026-49824

creationtimestamp| type| source ---|---|--- 2026-06-10 19:07:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxfttjf2f2q...

CVE-2026-0273

creationtimestamp| type| source ---|---|--- 2026-06-10 19:03:31+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mnxfn6ayke2z 2026-06-10 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1917 2026-06-11 03:03:21+00:00| seen|...

CVE-2026-0267

creationtimestamp| type| source ---|---|--- 2026-06-10 19:03:23+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mnxfmwtg2m2k 2026-06-10 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1917 2026-06-10 22:58:09+00:00| seen|...

CVE-2026-49821

creationtimestamp| type| source ---|---|--- 2026-06-10 19:02:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxflcnabj26...

MAL-2026-5526 Malicious code in chai-check-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e290b42de2cbd4aa74afa6550fc9a0381dfcb0f6996dcdc22254268b391f9f8 [email protected] impersonates the legitimate chaijs/check-error utility copied README, author metadata, repository URL, and exported API surfac...

CVE-2026-20255

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious classic dashboard that...

CVE-2026-45552

creationtimestamp| type| source ---|---|--- 2026-06-10 18:05:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnxcftj7pj2b...

CVE-2026-46616

Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in the CMS provide to support member related operations fail to validate redirect URLs, making Razor templates that derive 'RedirectUrl' from user-controlled query parameters vulnerable to malicious...