CVE-2026-42595

creationtimestamp| type| source ---|---|--- 2026-04-30 19:10:29+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-chwh-f6gm-r836 2026-05-21 12:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmef26igky2y...

CVE-2026-42593

creationtimestamp| type| source ---|---|--- 2026-04-30 18:31:56+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-3cv5-q585-h563 2026-05-14 17:49:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltevnjauu2r...

CVE-2026-42591

creationtimestamp| type| source ---|---|--- 2026-04-30 18:31:27+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rm4c-xj6x-49mw 2026-05-14 17:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltd3zcdo52v 2026-05-21 11:37:06+00:0...

n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

Impact In the SDK embedder path N8NDocumentationMCPServer constructor, getN8nApiClient, and validateInstanceContext, the synchronous URL validator in SSRFProtection.validateUrlSync had no IPv6 checks. IPv4-mapped IPv6 addresses such as http://::ffff:169.254.169.254 bypassed the cloud-metadata,...

CVE-2026-7164

creationtimestamp| type| source ---|---|--- 2026-04-30 18:07:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkq7ffyvby2t 2026-05-04 06:44:59+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/freebsd-security-advisory-av26-415 2026-05-04 14:19:13+00:00| seen|...

GHSA-CWCX-382V-8M9G Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Impact An authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo URL pointing at a private address e.g. http://127.0.0.1:999...

CVE-2026-7382

creationtimestamp| type| source ---|---|--- 2026-04-30 16:54:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkq3croerr2v...

CVE-2024-13971

creationtimestamp| type| source ---|---|--- 2026-04-30 16:36:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkq2bwcdzl2c...

CVE-2026-3861

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...

CVE-2026-0205

creationtimestamp| type| source ---|---|--- 2026-04-30 13:55:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkprcb5i6n2c 2026-05-01 02:58:40+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mkr52zptik2e 2026-07-21 04:00:07+00:00| seen|...

CVE-2026-40687

creationtimestamp| type| source ---|---|--- 2026-04-30 13:50:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkpqz242uz27 2026-05-02 04:40:22+00:00| seen| https://vulnerability.circl.lu/bundle/1f150b5f-d6d1-40b6-94cc-7bd855a097ec 2026-05-25 20:02:13+00:00| seen|...

CVE-2026-7163 Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure

A vulnerability in the assisted-service REST API, an optional Assisted Installer assisted-service component in the Multicluster Engine MCE, allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.60 packages and security update

Red Hat OpenShift Container Platform release 4.16.60 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

CVE-2026-4412

creationtimestamp| type| source ---|---|--- 2026-04-30 11:49:01+00:00| seen| https://bsky.app/profile/newstecnicas.info.ve/post/3mkpkaf3h422m 2026-04-30 14:07:27+00:00| seen| https://bsky.app/profile/newstecnicas.info.ve/post/3mkprxu5j6c2r 2026-05-01 00:36:13+00:00| seen|...

CLSA-2026-1777545539 Fix of 6 CVEs

SECURITY UPDATE: fix quadratic complexity in http cookie parsing with backslash escapes - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in http cookie parsing with backslash escapes - CVE-2024-7592 SECURITY UPDATE: reject leading dashes in webbrowser URLs and %action substitution...

CVE-2026-37554

creationtimestamp| type| source ---|---|--- 2026-04-30 08:49:17+00:00| seen| https://gist.github.com/sgInnora/45128ae15d52df7238680a8f2da8359f 2026-05-11 20:29:17+00:00| seen| https://gist.github.com/tw89Coder/cd011dc1842625f821c171e41e812fbc...

CVE-2026-41226

Open redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack...

Exploit for CVE-2026-42141

CVE-2026-42141 - xibo CMS SSRF SSRF vulnerability in Xibo CMS...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...