EUVD-2026-25106

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server to fetch arbitrary URLs, including localhost/private network targets, and persist the response as ...

CVE-2026-41170 Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the RestoreController.PostRestoreJob endpoint allows an administrator to supply an arbitrary URL for downloading backup archives. This URL is fetched using the "Backup" HttpClient...

CVE-2026-41455

CVE-2026-41455 affects WeKan

CVE-2019-25714

creationtimestamp| type| source ---|---|--- 2026-04-22 21:02:30+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mk4fgsrcnp2x...

CVE-2026-34415

creationtimestamp| type| source ---|---|--- 2026-04-22 20:01:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4bzgzyko2r 2026-04-22 21:21:17+00:00| published-proof-of-concept| Telegram/he0Z1Xxb4PMjQ5eYVBKNYLHtJZg-G0d3XJmG72co7nWMuw 2026-04-23 07:30:28+00:00| seen|...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the POST /api/lunchflow/link endpoint, which insufficiently validates user-supplied URLs and fails to restrict access to internal or sensitive network addresses. An attacker can cause the server to...

CVE-2025-9611

creationtimestamp| type| source ---|---|--- 2026-04-22 18:52:48+00:00| seen| https://gist.github.com/zachsmith1/a3c31a2b8e89ae1c6c771034a97ffd67...

Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain

Cybersecurity researchers have warned of malicious images pushed to the official "checkmarx/kics" Docker Hub repository. In an alert published today, software supply chain security company Socket revealed that unknown threat actors managed to have overwritten existing tags, including v2.1.20 and...

i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

Summary Versions of i18next-http-backend prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input the defau...

GHSA-Q89C-Q3H5-W34G i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

Summary Versions of i18next-http-backend prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input the defau...

CVE-2026-35548

creationtimestamp| type| source ---|---|--- 2026-04-22 17:17:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3yu6h6v32p 2026-04-22 19:14:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk47eyh6d32l...

CVE-2018-25270

creationtimestamp| type| source ---|---|--- 2026-04-22 17:12:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3yl7zcvv2h 2026-05-31 19:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn6ctysno32z...

CVE-2018-25268

creationtimestamp| type| source ---|---|--- 2026-04-22 17:02:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3xzd6sia2v 2026-05-31 08:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mn54cagsak26...

CVE-2018-25266

creationtimestamp| type| source ---|---|--- 2026-04-22 16:57:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3xqergbc2e...

CVE-2018-25271

creationtimestamp| type| source ---|---|--- 2026-04-22 16:52:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3xhgdodg2n...

CVE-2018-25262

creationtimestamp| type| source ---|---|--- 2026-04-22 16:22:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3vrxujzu2i...

CVE-2018-25272

creationtimestamp| type| source ---|---|--- 2026-04-22 16:19:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3vm5jpdp2n...

python: Python: Command-line option injection in webbrowser.open() via crafted URLs

A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...

CVE-2026-31500

creationtimestamp| type| source ---|---|--- 2026-04-22 15:24:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116449047471699253 2026-07-02 07:15:52+00:00| seen| https://www.hkcert.org/security-bulletin/suse-linux-kernel-multiple-vulnerabilities20260702 2026-07-06 05:50:11+00:00| see...

CVE-2026-1913

creationtimestamp| type| source ---|---|--- 2026-04-22 13:13:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mk3laa6wof2r 2026-04-24 15:33:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mkatxnvegv2q...