CVE-2026-35404

creationtimestamp| type| source ---|---|--- 2026-04-06 22:06:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miubkm6pny2g...

CVE-2026-35411

creationtimestamp| type| source ---|---|--- 2026-04-06 22:04:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miubhmieib27...

CVE-2026-35411 Directus is an Open Redirect in Admin 2FA Setup Page

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication 2FA visits a...

CVE-2026-35411 Directus is an Open Redirect in Admin 2FA Setup Page

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication 2FA visits a...

CVE-2026-35404

Open edX Platform is affected by CVE-2026-35404 due to an unvalidated redirect_url parameter in the view_survey endpoint. The parameter is passed directly to HttpResponseRedirect(), causing a 302 redirect when a non-existent survey name is requested. The same unvalidated URL is also returned in a...

CVE-2026-35404 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter

Open edX Platform enables the authoring and delivery of online learning at any scale. The viewsurvey endpoint accepts a redirecturl GET parameter that is passed directly to HttpResponseRedirect without any URL validation. When a non-existent survey name is provided, the server issues an immediate...

CVE-2026-35404

Open edX Platform enables the authoring and delivery of online learning at any scale. The viewsurvey endpoint accepts a redirecturl GET parameter that is passed directly to HttpResponseRedirect without any URL validation. When a non-existent survey name is provided, the server issues an immediate...

CVE-2026-35404 Open edX Platform has an Open Redirect in Survey Views via Unvalidated redirect_url Parameter

Open edX Platform enables the authoring and delivery of online learning at any scale. The viewsurvey endpoint accepts a redirecturl GET parameter that is passed directly to HttpResponseRedirect without any URL validation. When a non-existent survey name is provided, the server issues an immediate...

CVE-2026-35394

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobileopenurl tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls...

CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobileopenurl tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls...

CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobileopenurl tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls...

CVE-2026-35394 Mobile Next has Arbitrary Android Intent Execution via mobile_open_url

Mobile Next is an MCP server for mobile development and automation. Prior to 0.0.50, the mobileopenurl tool in mobile-mcp passes user-supplied URLs directly to Android's intent system without any scheme validation, allowing execution of arbitrary Android intents, including USSD codes, phone calls...

CVE-2024-48783

creationtimestamp| type| source ---|---|--- 2026-04-06 20:51:48+00:00| seen| https://bsky.app/profile/allsafeus.bsky.social/post/3miu5ewvcf22q...

CVE-2026-35187

CVE-2026-35187 affects pyload/pyload-ng prior to 0.5.0b3.dev97, where parse_urls(...) calls get_url(url) without URL validation, protocol restriction, or IP blacklist. This enables Server-Side Request Forgery (SSRF) via crafted URLs and multi‑protocol support (http/https, file://, gopher://, dict...

CVE-2026-35187

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, the parseurls API function in src/pyload/core/api/init.py fetches arbitrary URLs server-side via geturlurl pycurl without any URL validation, protocol restriction, or IP blacklist. An authenticated...

GHSA-78H2-9FRX-2JM8

creationtimestamp| type| source ---|---|--- 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM 2026-04-10 17:08:55+00:00| seen| https://gist.github.com/paulo-raca/8a16df3664952c9b185211298075c6ab...

CVE-2026-35164

creationtimestamp| type| source ---|---|--- 2026-04-06 19:25:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitykuak322n 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8 2026-04-07 06:02:51+00:00| seen|...

CVE-2026-5668

creationtimestamp| type| source ---|---|--- 2026-04-06 19:04:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitxewiwuz2j...

CVE-2026-34981

creationtimestamp| type| source ---|---|--- 2026-04-06 18:53:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitwruq3y22s...

CVE-2024-14032

creationtimestamp| type| source ---|---|--- 2026-04-06 18:52:21+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mitwpdda7s2z 2026-04-14 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjgfmj3sxd2v...