PT-2026-35917

Name of the Vulnerable Software and Affected Versions Jenkins GitHub Plugin versions prior to 1.46.1 Description Improper processing of the current job URL within the JavaScript used to validate the "GitHub hook trigger for GITScm polling" feature allows non-anonymous attackers with Overall/Read...

PT-2026-35916

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea d580c1a b a and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL with attacker-specified GitHub App credentials...

Jenkins GitHub Plugin 跨站脚本漏洞

The Jenkins GitHub Plugin is an open-source plugin for Jenkins that provides integration with code hosting platforms for continuous integration systems. The Jenkins GitHub Plugin versions 1.46.0 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from improper...

CVE-2026-42432

creationtimestamp| type| source ---|---|--- 2026-04-28 21:10:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mklio626qh2i...

Security Bulletin: Server-Side Request Forgery (SSRF) in Langflow URL Component

Summary IBM Langflow Desktop contains a Server-Side Request Forgery SSRF vulnerability in the URL data source component where user-supplied URLs are insufficiently validated before being used in backend HTTP requests, allowing authenticated attackers to force the Langflow server to make arbitrary...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-7354

creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 00:20:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkltd2klvx2p 2026-05-03 18:00:00+00:00| seen|...

CVE-2026-7346

creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 00:33:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkltzjp3az2h 2026-05-03 18:00:00+00:00| seen|...

CVE-2026-7352

creationtimestamp| type| source ---|---|--- 2026-04-28 20:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260429 2026-04-29 00:22:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkltfqpevd2i 2026-05-10 11:02:09+00:00| seen|...

CVE-2026-7291

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-41391 OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling

OpenClaw before 2026.3.31 fails to properly sanitize PIPINDEXURL and UVINDEXURL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting...

CVE-2026-41391

OpenClaw before 2026.3.31 fails to properly sanitize PIPINDEXURL and UVINDEXURL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting...

EUVD-2026-26080

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful...

CVE-2026-7291

Technical details (affected products, versions, root cause, impact, and remediation) are not publicly available in the provided documents; monitor for updates.

EUVD-2026-26074

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-7291 o2oa URL Fetching FileAction.java FileAction server-side request forgery

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-7291 o2oa URL Fetching FileAction.java FileAction server-side request forgery

A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit ha...

CVE-2026-24186

creationtimestamp| type| source ---|---|--- 2026-04-28 16:53:26+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116483372219679349 2026-04-28 21:54:31+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkll5e32xe2a 2026-05-25 20:37:06+00:00| seen|...

CVE-2026-7288

creationtimestamp| type| source ---|---|--- 2026-04-28 16:47:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkzyjfb672r 2026-04-28 16:56:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkl2irbp352e 2026-05-28 10:07:15+00:00| seen|...

CVE-2026-27760

creationtimestamp| type| source ---|---|--- 2026-04-28 16:34:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkzbukgyd2p 2026-06-17 09:12:42+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-27760.yaml 2026-09-08...