CVE-2026-5808

A vulnerability was detected in openstatusHQ openstatus up to 1b678e71a85961ae319cbb214a8eae634059330c. This impacts an unknown function of the file apps/dashboard/src/app/dashboard/onboarding/client.tsx of the component Onboarding Endpoint. The manipulation of the argument callbackURL results in...

CVE-2026-5808 openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting

A vulnerability was detected in openstatusHQ openstatus up to 1b678e71a85961ae319cbb214a8eae634059330c. This impacts an unknown function of the file apps/dashboard/src/app/dashboard/onboarding/client.tsx of the component Onboarding Endpoint. The manipulation of the argument callbackURL results in...

CVE-2026-5808

The CVE-2026-5808 entry affects openstatusHQ OpenStatus with the Onboarding Endpoint component. The vulnerability is tied to the file apps/dashboard/src/app/(dashboard)/onboarding/client.tsx, where manipulation of the argument callbackURL enables cross-site scripting. It can be triggered remotely...

CVE-2026-25460

creationtimestamp| type| source ---|---|--- 2026-04-08 21:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mizahcai722w...

CVE-2026-27629

creationtimestamp| type| source ---|---|--- 2026-04-08 21:01:14+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3miz6tnr46m2h...

CVE-2026-39862

Tophat is a mobile applications testing harness. Prior to 2.5.1, Tophat is affected by remote code execution via crafted tophat:// or http://localhost:29070 URLs. The arguments query parameter flows unsanitized from URL parsing through to /bin/bash -c execution, allowing an attacker to execute...

Server-side Request Forgery (SSRF)

Overview n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol MCP Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the instance-URL header in multi-tenant HTTP mode. An authenticated attacker can cause the server to issue HTT...

GHSA-4GGG-H7PH-26QR n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode

Impact An authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTHTOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the conten...

n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode

Impact An authenticated Server-Side Request Forgery in n8n-mcp allows a caller holding a valid AUTHTOKEN to cause the server to issue HTTP requests to arbitrary URLs supplied through multi-tenant HTTP headers. Response bodies are reflected back through JSON-RPC, so an attacker can read the conten...

CVE-2026-39369

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storag...

CVE-2026-39362 InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREEDOWNLOADFROMURL is enabled opt-in, authenticated users can supply remoteimage URLs that are fetched server-side via requests.get with only Django's URLValidator check. There is no validation against...

CVE-2025-50669

creationtimestamp| type| source ---|---|--- 2026-04-08 19:30:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116370742055082948...

CVE-2026-35400

LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, an endpoint in the publication module was incorrectly trusting the baseURL submitted by a user's PO...

CVE-2025-50661

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /urlrule.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, en, ips, u, time, act, rpri, and log...

CVE-2025-50662

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /urlgroup.asp endpoint...

CVE-2025-50660

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /urlmember.asp endpoint...

CVE-2026-56078

creationtimestamp| type| source ---|---|--- 2026-04-08 19:21:32+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-766v-q9x3-g744 2026-06-19 01:29:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mom6w2ozwi2r...

CVE-2025-50668

creationtimestamp| type| source ---|---|--- 2026-04-08 19:03:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116370636293391705...

CVE-2026-33460

creationtimestamp| type| source ---|---|--- 2026-04-08 18:59:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyxzeweqw2i 2026-04-09 12:45:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mj2tlogbtp2z...

EUVD-2026-20507

A flaw was found in mirror-registry. Authenticated users can exploit the log export feature by providing a specially crafted web address URL. This allows the application's backend to make arbitrary requests to internal network resources, a vulnerability known as Server-Side Request Forgery SSRF...