112562 matches found
CVE-2026-42259
Technical details are not publicly available in the provided Connected documents. Monitor for updates on Saltcorn CVE-2026-42259 for any vendor advisories or patches beyond the initial description.
EUVD-2026-28431
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes \ to forward...
CVE-2026-42259 Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)
Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes \ to forward...
CVE-2026-8081
A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...
Important: Red Hat Security Advisory: buildah security update
An update for buildah is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
CVE-2026-41905 FreeScout vulnerable to SSRF via Helper::sanitizeRemoteUrl: redirect destination not re-validated, allowing internal HTTP / cloud-metadata access
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl in app/Misc/Helper.php follows HTTP redirects via curlGetLastRedirectedUrl but then re-validates the original URL instead of the final redirect destination. An...
CVE-2026-41687
creationtimestamp| type| source ---|---|--- 2026-05-07 18:02:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbsf3j6jh2p...
CVE-2026-8081
CVE-2026-8081 affects router-for-me CLIProxyAPI 6.9.29. The vulnerability is a server-side request forgery in the API Tools handler (internal/api/handlers/management/api_tools.go) caused by manipulating the url argument. This enables remote exploitation as disclosed publicly. Remediation details ...
CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery
A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...
CVE-2026-8081 router-for-me CLIProxyAPI api_tools.go server-side request forgery
A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/apitools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote...
CLSA-2026-1778175425 curl: Fix of 2 CVEs
CVE-2016-8624: invalid URL parsing with '' - CVE-2016-8623: use-after-free via shared cookies...
GHSA-GR3R-CRP5-QRRM
creationtimestamp| type| source ---|---|--- 2026-05-07 17:10:29+00:00| seen| https://gist.github.com/alon710/56ddf2e902ba484e9ffc934e550f18ab...
Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for...
GHSA-J944-W549-3453 Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker
Impact A remote authenticated attacker who shares a room with a victim and has permissions to create room emotes for example in a DM can cause the victim's client to send their Matrix access token to an attacker-controlled server. This occurs when the victim opens the emoji or sticker picker for...
CVE-2026-5385
creationtimestamp| type| source ---|---|--- 2026-05-07 16:00:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlblk4t3e52k 2026-06-02 13:45:21+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mncq4nolce2y 2026-06-02 20:51:19+00:00| seen|...
CVE-2026-42321
creationtimestamp| type| source ---|---|--- 2026-05-07 16:00:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlblk4t3e52k 2026-06-02 13:45:20+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mncq4nolce2y...
Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting xss vulnerability via crafted URL being rended from cron.erb...
EUVD-2025-209725
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting xss vulnerability via crafted URL being rended from cron.erb...
GHSA-XV9C-MJW8-79GF Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL
Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting xss vulnerability via crafted URL being rended from cron.erb...