CVE-2026-34475

A flaw was found in Varnish Cache and Varnish Enterprise. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 requests with a path of / in the URL. This mishandling of URLs, specifically in unchecked req.url scenarios, could lead to cache poisoning, where an...

CVE-2026-30082

creationtimestamp| type| source ---|---|--- 2026-03-30 09:00:05+00:00| published-proof-of-concept| Telegram/DqnxSYvTkOomdEHsHt5FS0pAUl5hbOLNZkPHd3yXBmZyd4 2026-03-30 16:07:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mic27lsame2t 2026-03-30 21:00:05+00:00|...

CVE-2026-34716

creationtimestamp| type| source ---|---|--- 2026-03-30 08:29:09+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-w4hp-w536-jg64 2026-03-31 22:32:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifa6vdvem2i...

CVE-2026-34611

creationtimestamp| type| source ---|---|--- 2026-03-30 08:01:23+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-c4xj-x7p8-3x7q 2026-03-31 22:25:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mif7tkalfa2t...

CVE-2026-27798

creationtimestamp| type| source ---|---|--- 2026-03-30 07:02:34+00:00| seen| https://infosec.exchange/users/certvde/statuses/116316841599408182...

CVE-2026-27799

creationtimestamp| type| source ---|---|--- 2026-03-30 07:02:34+00:00| seen| https://infosec.exchange/users/certvde/statuses/116316841599408182...

CVE-2026-30931

creationtimestamp| type| source ---|---|--- 2026-03-30 07:02:33+00:00| seen| https://infosec.exchange/users/certvde/statuses/116316841599408182...

CVE-2026-28686

creationtimestamp| type| source ---|---|--- 2026-03-30 07:02:33+00:00| seen| https://infosec.exchange/users/certvde/statuses/116316841599408182...

CVE-2026-5102

creationtimestamp| type| source ---|---|--- 2026-03-30 02:05:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mial6nwij523...

Node.js 安全漏洞

Node.js is an open-source, cross-platform JavaScript runtime environment developed by the Node.js community. There is a security vulnerability in Node.js, which stems from improper handling of URLs. When the url.format function is called with an internationalized domain name containing invalid...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

KubePlus 安全漏洞

KubePlus is a Kubernetes multi-tenant application management platform developed by cloud-ark. KubePlus 4.1.4 contains security vulnerabilities, which stem from server-side request forgery and command injection during the processing of the chartURL field by the mutating webhook and...

HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect

ManagedWebAccessUtils.getServer uses String.startsWith to match request URLs against configured server URLs for authentication credential dispatch. Because configured server URLs e.g., http://tx.fhir.org lack a trailing slash or host boundary check, an attacker-controlled domain like...

CVE-2026-29954

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...

Linux Distros Unpatched Vulnerability : CVE-2026-33748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient...

CVE-2026-29954

CVE-2026-29954 affects KubePlus 4.1.4, specifically the mutating webhook and kubeconfiggenerator. The vulnerability arises when processing the chartURL field of ResourceComposition resources: the value is only URL-encoded and not validated, enabling SSRF. More critically, kubeconfiggenerator conc...

PT-2026-29088

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.4 Description Nginx UI improperly handles URL-encoded traversal sequences in its configuration, potentially leading to a partial Denial of Service. Specifically, specially crafted paths can cause the backend to...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1482)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1482 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or...

CVE-2026-34601

creationtimestamp| type| source ---|---|--- 2026-03-29 20:03:08+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp 2026-04-02 19:27:20+00:00| published-proof-of-concept| Telegram/zJs9VhJAI5JOvrL4hzeWnrOleMDgHArbbwhOuzjaL80cudA 2026-04-03...

CVE-2026-23398

creationtimestamp| type| source ---|---|--- 2026-03-29 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0376/ 2026-04-05 21:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/78986 2026-04-05 23:00:14+00:00| published-proof-of-concept|...