CVE-2026-13346

creationtimestamp| type| source ---|---|--- 2026-07-29 19:33:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mrso5c35vn24...

CVE-2026-59083

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

CVE-2026-3093

GitLab CE/EE contains a Cross-site Scripting (XSS) flaw (CVE-2026-3093) caused by improper sanitization of user-controlled input during web page generation. Affected versions are 14.0 up to 19.0.4, 19.1 up to 19.1.2, and 19.2 up to 19.2.0. Under certain conditions, an attacker could trigger arbit...

EUVD-2026-50486

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-3093

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

CVE-2026-67428

The CVE-2026-67428 entry concerns Flyto2 Core, an automation/AI-agent workflow kernel. Before version 2.26.7, multiple HTTP-emitting modules (including http/requests.py, core.api.http_get, core.api.http_post, graphql.query/mutation, monitor.http_check, communication.slack_send, notification.disco...

CVE-2026-67428 Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/thirdparty/developer/http/requests.py, core.api.httpget, core.api.httppost, graphql.query, graphql.mutation, monitor.httpcheck, communication.slacksend,...

CVE-2026-18236

creationtimestamp| type| source ---|---|--- 2026-07-29 18:46:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrslj4mpd52z 2026-08-01 12:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrzjagb67l2l...

CVE-2026-67426 Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...

CVE-2026-67426

Flyto2 Core contains an unauthenticated SSRF risk in the standalone flyto-verification service (src/core/verification_service.py) prior to version 2.26.7. The service exposed POST /run on 0.0.0.0:8344 and used a client-supplied callback_url for outbound POSTs with X-Internal-Key: $FLYTO_RUNNER_SE...

CVE-2026-67426

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verificationservice.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callbackurl for an outbound POST with X-Internal-Key:...

CVE-2026-67425

CVE-2026-67425 affects Flyto2 Core. Prior to version 2.26.6, the component llm.chat reads provider keys (e.g., OPENAI_API_KEY, ANTHROPOLIC_API_KEY) from the environment and transmits them in an Authorization: Bearer header to a caller-controlled base_url, enabling an attacker to exfiltrate the op...

CVE-2026-67425 Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAIAPIKEY and ANTHROPICAPIKEY from the environment and sends them in the Authorization: Bearer header to caller-controlled baseurl, allowing an attacker to receive th...

CVE-2026-8339

creationtimestamp| type| source ---|---|--- 2026-07-29 18:14:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsjqz32g62x...

CVE-2026-54078

creationtimestamp| type| source ---|---|--- 2026-07-29 17:48:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrsibnyxwe2o...

Security Bulletin: IBM Integration Bus for z/OS is vulnerable to Improper Handling of URL Encoding and Insufficient Technical Documentation due to Apache Tomcat (CVE-2026-59083 & CVE-2026-59084)

Summary IBM Integration Bus for z/OS is vulnerable to Improper Handling of URL Encoding and Insufficient Technical Documentation due to Apache Tomcat. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite...

CVE-2026-12703

creationtimestamp| type| source ---|---|--- 2026-07-29 16:33:06+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrse3check23...

CVE-2026-56848

creationtimestamp| type| source ---|---|--- 2026-07-29 15:29:55+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mrsakcypyy2r 2026-07-30 04:46:32+00:00| seen| https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities20260730 2026-07-30 14:15:24+00:00| seen|...