112785 matches found
CVE-2026-33810
creationtimestamp| type| source ---|---|--- 2026-04-08 04:08:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mixgbdohyb2z 2026-04-13 21:22:20+00:00| seen| Telegram/xEAlzuvdoDbl3-4UvjRUOPM0QQ9w8kB8O-gQzs6j3EZAGw 2026-05-06 14:30:24+00:00| seen|...
CVE-2026-3499
creationtimestamp| type| source ---|---|--- 2026-04-08 03:17:02+00:00| seen| Telegram/OIususpWixIDiQQq7x0EEBhUibUD-5oYLPzoeXaqET3sKo 2026-04-08 04:24:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mixh4hu6j22s 2026-04-21 06:44:07+00:00| seen|...
CVE-2026-39885
creationtimestamp| type| source ---|---|--- 2026-04-08 02:35:34+00:00| published-proof-of-concept| https://github.com/agentfront/frontmcp/security/advisories/GHSA-v6ph-xcq9-qxxj 2026-04-08 02:35:34+00:00| published-proof-of-concept|...
CVE-2026-39411
creationtimestamp| type| source ---|---|--- 2026-04-08 02:20:20+00:00| published-proof-of-concept| https://github.com/lobehub/lobehub/security/advisories/GHSA-5mwj-v5jw-5c97 2026-04-08 22:21:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mizddehwyw2t...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-31920
creationtimestamp| type| source ---|---|--- 2026-04-08 00:30:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mix22atrfi2t 2026-05-01 03:01:53+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mkr5asb5fc2u...
Server-side Request Forgery (SSRF)
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the downloadURL parameter processing in objects/aVideoEncoder.json.php. An attacker can access internal resources and exfiltrat...
EUVD-2026-19886
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration Incomplete fix for CVE-2026-27732...
EUVD-2026-19883
WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs...
GHSA-F4F9-627C-JH33 WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs
Summary objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local...
Server-side Request Forgery (SSRF)
Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the restreamerURL parameter of the restream log callback flow. An attacker can access internal network resources and retrieve...
Arbitrary Argument Injection
Overview skilleton is a Skills skeleton: deterministic AI skill dependency manager Affected versions of this package are vulnerable to Arbitrary Argument Injection via improper handling of repository and path input in the normalizeRepoUrl function. An attacker can cause unsafe or inefficient...
WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
The Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and...
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)
The fix for CVE-2026-27732 is incomplete. objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then fetches the response and stores it ...
CVE-2025-50660
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of the name parameter in the /urlmember.asp endpoint...
CVE-2025-50661
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /urlrule.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, en, ips, u, time, act, rpri, and log...
RHEL 8 : grafana (RHSA-2026:7011)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:7011 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/url: Incorrect...
Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...
ALSA-2026:7011 Important: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...
