CVE-2025-13478

creationtimestamp| type| source ---|---|--- 2026-03-27 15:17:36+00:00| seen| Telegram/LBnoZEkIgYZcAalPkuHtbpp5d2DNhQfVZICyQCgDXFXXQ 2026-03-27 16:00:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi2ihfqmai2d...

CVE-2026-4984

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When processing media messages, it fetches user-controlled URLs 'MediaUrlN' parameters using HTTP requests that include the integration's Twilio credentials in the 'Authorization'...

CVE-2026-33748

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is...

CLSA-2026-1774622460 squid: Fix of 3 CVEs

CVE-2025-59362: fix ASN.1 encoding of long SNMP OIDs - CVE-2026-33526: do not escape malformed URI twice when sending ICP errors - CVE-2026-33515: fix validation of ICP packet sizes and URLs...

CVE-2026-5021

creationtimestamp| type| source ---|---|--- 2026-03-27 14:36:37+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116301640210905220 2026-03-29 02:45:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi64wy5frl2g 2026-03-29 03:00:28+00:00| seen|...

CVE-2026-5010

A reflected Cross-Site Scripting XSS vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user...

CVE-2026-5010

A reflected XSS vulnerability in Sanoma’s Clickedu is triggered via the /user.php/ endpoint. An attacker can lure a user to a malicious URL, causing JavaScript to run in the victim’s browser. Impact described includes potential theft of session cookies or performing actions on behalf of the user....

CVE-2026-5010 Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu

A reflected Cross-Site Scripting XSS vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user...

CVE-2021-27577

Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1...

CVE-2021-27670

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter...

CVE-2026-33748

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is...

CVE-2026-33748

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is...

CVE-2026-33284 GlobalLeaks has insufficient URL validation in user support API

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches...

CVE-2026-33284 GlobalLeaks has insufficient URL validation in user support API

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches...

CVE-2026-33205

Calibre (cross‑platform e‑book manager) has a Server-Side Request Forgery in the ebook viewer’s web view, exposed via the background-image endpoint. Prior to version 9.6.0, an attacker could perform blind GET requests to arbitrary URLs and exfiltrate data from the ebook sandbox. The issue is fixe...

CVE-2026-1995

creationtimestamp| type| source ---|---|--- 2026-03-27 12:55:52+00:00| seen| https://bsky.app/profile/oxfemale.bsky.social/post/3mi264ootpj22 2026-03-29 05:15:56+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mi6fe3r6es2g...

CVE-2026-0394

creationtimestamp| type| source ---|---|--- 2026-03-27 12:13:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi23qsvkva2g...

CVE-2026-27857

creationtimestamp| type| source ---|---|--- 2026-03-27 12:10:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi23lwink725 2026-07-23 14:01:23+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mrcysickuj23...

yggdrasil-worker-package-manager security update

An update is available for yggdrasil-worker-package-manager. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list yggdrasil-worker-package-manager is a simple packag...

Security update for python311

This update for python311 fixes the following issues: Update to python 3.11.15: CVE-2025-6075: quadratic complexity in os.path.expandvars bsc1252974. CVE-2025-11468: header injection with carefully crafted inputs bsc1257029. CVE-2025-12084: quadratic complexity in xml.minidom node ID cache cleari...