CVE-2026-39364

creationtimestamp| type| source ---|---|--- 2026-04-06 12:12:37+00:00| published-proof-of-concept| https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r 2026-04-07 21:22:19+00:00| seen| Telegram/ORzlugWNJSN1mBT3L8tDKZ1H7oYKkiEmKL9E7e5xnpgHaiU 2026-04-07 22:58:19+00:00| seen|...

CVE-2026-39363

creationtimestamp| type| source ---|---|--- 2026-04-06 12:11:59+00:00| published-proof-of-concept| https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583 2026-04-07 21:22:19+00:00| seen| Telegram/ORzlugWNJSN1mBT3L8tDKZ1H7oYKkiEmKL9E7e5xnpgHaiU 2026-04-07 22:49:01+00:00| seen|...

CVE-2026-5642

creationtimestamp| type| source ---|---|--- 2026-04-06 11:15:48+00:00| published-proof-of-concept| Telegram/Z9ilPgM8N-vlYjxsXZCfRRqxqCtJw33K7Kit4-JTjgItxjI 2026-04-06 12:59:04+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mitcxnbmog2e 2026-04-06 14:14:06+00:00| seen|...

CVE-2026-34954

PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.downloadfile in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream with followredirects=True. An attacker who controls the URL can reach any...

CVE-2026-34936

PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough and apassthrough in praisonai accept a caller-controlled apibase parameter that is concatenated with endpoint and passed directly to httpx.Client.request when the litellm primary path raises AttributeError. No URL schem...

CVE-2026-22662

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests...

CVE-2026-5635

creationtimestamp| type| source ---|---|--- 2026-04-06 10:48:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mit3npwoam2n...

BIT-NODE-MIN-2026-21712

A flaw in Node.js URL processing causes an assertion failure in native code when url.format is called with a malformed internationalized domain name IDN containing invalid characters, crashing the Node.js process...

BIT-NODE-2026-21712

A flaw in Node.js URL processing causes an assertion failure in native code when url.format is called with a malformed internationalized domain name IDN containing invalid characters, crashing the Node.js process...

CVE-2026-5621

creationtimestamp| type| source ---|---|--- 2026-04-06 06:53:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3misokpgmin2i...

CVE-2026-5624

creationtimestamp| type| source ---|---|--- 2026-04-06 06:03:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mislqrohu423...

CVE-2026-5606

creationtimestamp| type| source ---|---|--- 2026-04-06 03:45:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mise2iigim2d...

CVE-2026-5607

creationtimestamp| type| source ---|---|--- 2026-04-06 03:37:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3misdm42lqm2j...

vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin

A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system OS command injection vulnerability exists in the netrw standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the scp://...

EUVD-2026-19144

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...

CVE-2019-25700

creationtimestamp| type| source ---|---|--- 2026-04-06 00:21:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mirymcy5hm2g 2026-04-07 21:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3miwqkcbxzr2c...

CVE-2026-5607 imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...

CVE-2026-5607

CVE-2026-5607 affects imprvhub mcp-browser-agent up to 0.8.0. The vulnerability resides in URL Parameter Handler’s CallToolRequestSchema within src/handlers.ts where manipulating request.params.name/request.params.arguments enables server-side request forgery. Public exploit disclosure and remote...

CVE-2026-5596

creationtimestamp| type| source ---|---|--- 2026-04-06 00:06:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mirxrhp4vo2q...

Mobile Next 安全漏洞

Mobile Next is an open-source mobile application automation development and testing tool developed by Mobile Next. Versions of Mobile Next prior to 0.0.50 contained security vulnerabilities. These vulnerabilities stemmed from the mobileopenurl tool not verifying the URL schemes provided by users,...