110992 matches found
CVE-2026-69078
CVE-2026-69078 affects CTI-Transmute: server-side request forgery via the evaluation report PDF rendering using WeasyPrint. User-supplied Markdown renders to HTML/PDF with unrestricted URL fetches, allowing retrieval of internal network resources and local files, and potential exposure through th...
CVE-2026-69078 Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...
CVE-2026-43373
creationtimestamp| type| source ---|---|--- 2026-08-03 07:03:30+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260803...
CVE-2026-18588
creationtimestamp| type| source ---|---|--- 2026-08-03 06:36:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5v2eavwb2m...
CVE-2025-71401
creationtimestamp| type| source ---|---|--- 2026-08-03 04:44:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms5os36ck22s 2026-08-04 11:24:49+00:00| seen| https://bsky.app/profile/cvemon.bsky.social/post/3msavnlqgs323...
CVE-2026-3245
creationtimestamp| type| source ---|---|--- 2026-08-03 03:42:59+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3ms5lerlfuh2p...
VulnCheck KEV: CVE-2026-54066
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...
CVE-2026-51190
The "s init" command in Serverless-Devs @serverless-devs/s = 3.1.11 passes unsanitized user input to childprocess.spawn with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument...
CVE-2026-67356
creationtimestamp| type| source ---|---|--- 2026-08-02 16:12:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4es7oylx2x...
CVE-2026-9856
creationtimestamp| type| source ---|---|--- 2026-08-02 15:59:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5g6qpc6sfh4ae...
CVE-2026-65321
creationtimestamp| type| source ---|---|--- 2026-08-02 15:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms4cjulwnx2z 2026-08-02 16:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3j3v5ifejd7bh 2026-08-02 16:09:38+00:00| seen|...
CVE-2026-58175
creationtimestamp| type| source ---|---|--- 2026-08-02 15:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3ms4b57ta672v...
CVE-2026-67309
creationtimestamp| type| source ---|---|--- 2026-08-02 14:46:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms47yxells24 2026-08-06 18:35:08+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-8rxv-jg7p-wvg3 2026-08-06 19:32:23+00:00| seen|...
CVE-2015-7326
creationtimestamp| type| source ---|---|--- 2026-08-02 14:45:13+00:00| seen| https://t.me/informationsec/185 2026-08-03 02:17:47+00:00| seen| https://t.me/informationsec/185...
CVE-2025-71401
better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...
CVE-2025-71401
The connected CVE entry describes a vulnerability in better-auth (npm) before 1.4.2 where an external request can configure baseURL when it is not defined (e.g., BETTER_AUTH_URL unset). An attacker who can trigger the first request after startup can poison the router’s base path, causing all rout...
EUVD-2025-210592
better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...
CVE-2025-71401 better-auth before 1.4.2 basePath Modification DoS
better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...
CVE-2025-71401 better-auth before 1.4.2 basePath Modification DoS
better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...