112288 matches found
openSUSE 16 Security Update : roundcubemail (openSUSE-SU-2026:20852-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20852-1 advisory. Changes in roundcubemail: - update to 1.6.16 - Fix potential too long value in IMAP ID command 10136 - Security: Fix stored XSS/HTML/CSS injecti...
PT-2026-45682
Cross-Site Scripting XSS in GeniexWebView component in Transsion AI Assistant Lifestyle application com.transsion.aiassistantlifestyle all versions on Android allows remote attacker to execute arbitrary JavaScript in the WebView context via crafted web action data URL parameter...
PT-2026-45708
Name of the Vulnerable Software and Affected Versions ZeM STL plugin for WordPress versions prior to 1.1 Description Stored Cross-Site Scripting is possible via the zemstl shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Specifically, the url, colo...
PT-2026-45866
Name of the Vulnerable Software and Affected Versions ahujasid blender-mcp versions prior to 5b37be25242e73dc4cf1328974d30458b9e5d67e Description An injection issue exists in the Open function within the src/blender mcp/server.py file. This occurs when the input image url argument is manipulated,...
PT-2026-45737
D.Launcher 2 component of Slovak eID client ecosystem contains Improper URL Handler Processing vulnerability. Application registers multiple custom URL handlers that could be exploited to initiate full NTLM autentication or SMB connection to attacker infrastructure and to conduct SSRF Server Side...
PT-2026-45723
Name of the Vulnerable Software and Affected Versions Wirtualna Uczelnia versions prior to wu2016.437.295020260327 105545 Description Server-Side Template Injection SSTI occurs when an unauthenticated attacker injects arbitrary template expressions into the server, which are then executed. This...
PT-2026-45801
NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page modules/Core/pages/profile.php processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. This allows any user with the profile.post permission to wri...
CVE-2026-10293
creationtimestamp| type| source ---|---|--- 2026-06-01 23:55:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnbbrihf4g2f...
CVE-2018-25432
creationtimestamp| type| source ---|---|--- 2026-06-01 23:41:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnbaxvphnn27...
CVE-2025-55664
creationtimestamp| type| source ---|---|--- 2026-06-01 22:32:24+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnb54fpn242t...
CVE-2026-44651
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetchurl throws, the code sends: res.status500.send'Error occurred while trying to proxy to:...
CVE-2026-49139
Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the...
CVE-2026-43958
creationtimestamp| type| source ---|---|--- 2026-06-01 20:06:42+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116676650304604017 2026-07-01 23:36:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmop2zljz2t 2026-07-05 17:46:24+00:00| seen|...
CVE-2026-43623
creationtimestamp| type| source ---|---|--- 2026-06-01 19:57:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnauhj5ln42e...
CVE-2026-49139
Summary: Nanobot before 0.2.1 contains a server-side request forgery (SSRF) in the Microsoft Teams channel handler, enabling attackers to exfiltrate Bot Framework bearer tokens. By sending a forged inbound activity with an attacker-controlled serviceUrl, an adversary can poison the stored convers...
EUVD-2026-33758
A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function getheaders of the file /index.php. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been...
CVE-2026-10287
The vulnerability affects SourceCodester SEO Meta Tag Extractor 1.0, specifically the get_headers function in /index.php. The issue arises from manipulating the url parameter, enabling server-side request forgery (SSRF) that can be initiated remotely. Exploit details have been publicly disclosed....
EUVD-2026-33738
A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack c...
CVE-2026-10280 horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery
A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack c...