uro

uro Usar una lista de URLs para pruebas de seguridad puede ser tedioso, ya que hay muchas URLs con contenido poco interesante/duplicado; uro tiene como objetivo solucionar eso. No realiza ninguna solicitud http a las URLs y elimina: URLs incrementales, p. ej. /page/1/ y /page/2/ publicaciones de...

EUVD-2026-97127

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

CVE-2026-108916: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and...

CVE-2026-109327: Improper Neutralization of Input During Web Page Generation

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-109559: Incorrect Authorization

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109422: Exposed Dangerous Method or Function

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to...

PT-2026-110579

Name of the Vulnerable Software and Affected Versions Progress ShareFile Storage Zones Controller versions prior to 5.12.7 Description Processing of queue items can send acknowledgements to an unvalidated callback URL. This behavior, combined with a race condition, allows an attacker to force the...

PT-2026-110927

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description Authenticated attackers can perform a server-side request forgery SSRF by providing a remote URL, such as a remote document or a syndicated site feed. The issue exists in the recuperer url function...

TencentOS Server 3: python-lxml (TSSA-2026:1123)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1123 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

EulerOS 2.0 SP11 : python-lxml (EulerOS-SA-2026-4367)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missin...

PT-2026-110799

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

EulerOS 2.0 SP13 : python-lxml (EulerOS-SA-2026-4186)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missin...

CVE-2026-75888: Server-Side Request Forgery (SSRF)

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery SSRF vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading t...

PT-2026-111094

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing "dot dot" sequences /../, an attacker can write arbitrary files ...

PT-2026-110597

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.22 Description A resource budget bypass allows remote attackers to override GLM-V video processing limits. By providing specific values in the video url object, attackers can manipulate the fps, max frames, max...

PT-2026-110963

Name of the Vulnerable Software and Affected Versions IBM Maximo Application Suite versions 8.10 through 9.2 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing "dot dot" sequences /../, an attacker can view arbitrary...

PT-2026-110421

Name of the Vulnerable Software and Affected Versions houtini-ai voice-analyser-mcp versions prior to 2.1.2 Description A server-side request forgery SSRF exists within the collect corpus component. This occurs when the fetch function in the src/utils/crawler.ts file improperly handles the sitema...

EulerOS 2.0 SP11 : python-lxml (EulerOS-SA-2026-4277)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missin...

EulerOS 2.0 SP13 : python-lxml (EulerOS-SA-2026-4095)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missin...

CVE-2026-92116: URL Redirection to Untrusted Site

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue...