CVE-2026-12971

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

Seagate Personal Cloud - File Read (CVE-2017-18263)

Reads arbitrary files via CVE-2017-18263 getPhotoPlaylistPhotos.psp?url= path. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud getPhotoPlaylistPhotos file read CVE-2017-18263.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

CVE-2026-19075

The All-in-One Video Gallery WordPress plugin (versions < 4.9.2 ) is vulnerable to Server-Side Request Forgery (SSRF) . The flaw exists because the plugin registers a public, unauthenticated file-download handler via the ?vdl= parameter on aiovg_videos posts. Specifically, the AIOVG_Public_Vid...

CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-19384

creationtimestamp| type| source ---|---|--- 2026-08-10 04:47:25+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mspcaigjkv2f...

CVE-2026-19383

creationtimestamp| type| source ---|---|--- 2026-08-10 02:37:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2fofomjudpidj...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

EUVD-2026-54961

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

EUVD-2026-54962

A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...

CVE-2026-19375

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

PT-2026-69403

Name of the Vulnerable Software and Affected Versions My Galaxy versions prior to 6.3 Description Improper authorization in the handler for a custom URL scheme allows remote attackers to access sensitive information. Recommendations Update to version 6.3 or later...

CVE-2026-64941: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

PT-2026-69428

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.9.0 Description An issue allows for privilege escalation through the manipulation of a URL parameter. Recommendations Upgrade to version 2.9.0...

CVE-2026-40920: Improper Privilege Management

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

PT-2026-69335

Name of the Vulnerable Software and Affected Versions LearnPress WordPress plugin versions prior to 4.4.4 Description Users with the instructor role can induce the server to issue requests to arbitrary external hosts because the plugin fails to validate a user-supplied URL before the server fetch...

ROS-20260810-73-0036

The vulnerability in python-authlib relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary URL addresses...

RHEL 8 : osbuild-composer (RHSA-2026:52390)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52390 advisory. An image building service based on osbuild It is inspired by lorax-composer and exposes the same API. As such, it is a drop-in replacement. Security...

...[ More ]

A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...

RHEL 8 : osbuild-composer (RHSA-2026:52389)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52389 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...