Improper Encoding or Escaping of Output

Overview AWSSDK.Extensions.CloudFront.Signers is a package contains extension methods for creating signed URLs for Amazon CloudFront distributions and for creating signed cookies for Amazon CloudFront distributions using canned or custom policies. Affected versions of this package are vulnerable ...

CVE-2026-33981

Technical details for CVE-2026-33981 are not publicly available in the provided documents. No affected products, impact, or remediation are identifiable here. Monitor for updates .

CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the jq: and jqraw: include filter expressions allow use of the jq env builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user or unauthenticated us...

CVE-2018-25185

creationtimestamp| type| source ---|---|--- 2026-03-27 22:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mi34k4xut52v...

CVE-2026-33875

creationtimestamp| type| source ---|---|--- 2026-03-27 21:44:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mi33nhrv5q2s 2026-03-27 23:10:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi3ai3stj22s 2026-03-27 23:27:39+00:00| seen|...

CVE-2026-33885 Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions an...

CVE-2026-33885 Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential

Statamic is a Laravel and Git powered content management system CMS. Prior to versions 5.73.16 and 6.7.2, the external URL detection used for redirect validation on unauthenticated endpoints could be bypassed, allowing users to be redirected to external URLs after actions like form submissions an...

UBUNTU-CVE-2026-34475

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass...

CVE-2026-4962

creationtimestamp| type| source ---|---|--- 2026-03-27 19:54:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2vjfnqgy2n...

Server-side Request Forgery (SSRF)

Overview letta is a Create LLM agents with long-term memory and custom tools Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the convertmessagecreatetomessage function in the File URL Handler component when processing the ImageContent argument. An attacker...

CVE-2026-34411

creationtimestamp| type| source ---|---|--- 2026-03-27 19:19:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2tl7ovon2t...

Cross-site Scripting (XSS)

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Credential Management Flow when a crafted OAuth2 credential contains a JavaScript URL in the Authorization URL field. An attacker can execute arbitrary scripts in th...

n8n has XSS in its Credential Management Flow

Impact An authenticated user with permission to create and share credentials could craft a malicious OAuth2 credential containing a JavaScript URL in the Authorization URL field. If a victim opened the credential and interacted with the OAuth authorization button, the injected script would execut...

CVE-2026-33758

creationtimestamp| type| source ---|---|--- 2026-03-27 17:22:30+00:00| seen| Telegram/j4uk2-mJi13Bei6kQkbjOgrQjosCkJncfaGDNG1RowRYM4 2026-03-30 21:39:12+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3micmrallwc2b...

Local Incus UI web server vulnerable to nuthentication bypass

Summary The web server spawned by incus webui incorrectly validates the authentication token such that an invalid value will be accepted. Details incus webui runs a local web server on a random localhost port. For authentication, it provides the user with a URL containing an authentication token...

CVE-2025-41026

Reflected Cross Site Scripting XSS vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' parameter in 'applogin.php'...

CVE-2026-4964

A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function convertmessagecreatetomessage of the file letta/helpers/messagehelper.py of the component File URL Handler. Such manipulation of the argument ImageContent leads to server-side request...

CVE-2026-5036

creationtimestamp| type| source ---|---|--- 2026-03-27 16:25:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116302066909306765 2026-03-28 16:16:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116307694173463292 2026-03-29 09:00:30+00:00| seen|...

CVE-2026-4340

creationtimestamp| type| source ---|---|--- 2026-03-27 15:54:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2i4mfgul2g...

GHSA-89V5-38XR-9M4J Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader

Summary Postiz has multiple SSRF vulnerabilities where user-provided URLs are fetched server-side without any IP validation or SSRF protection. Vulnerable Code 1. Webhook Send Endpoint Most Critical apps/backend/src/api/routes/webhooks.controller.ts lines 58-70: typescript async sendWebhook@Body...