112844 matches found
CVE-2026-33748
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is...
CVE-2026-33284 GlobalLeaks has insufficient URL validation in user support API
GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches...
CVE-2026-33284 GlobalLeaks has insufficient URL validation in user support API
GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches...
CVE-2026-33205
Calibre (cross‑platform e‑book manager) has a Server-Side Request Forgery in the ebook viewer’s web view, exposed via the background-image endpoint. Prior to version 9.6.0, an attacker could perform blind GET requests to arbitrary URLs and exfiltrate data from the ebook sandbox. The issue is fixe...
CVE-2026-1995
creationtimestamp| type| source ---|---|--- 2026-03-27 12:55:52+00:00| seen| https://bsky.app/profile/oxfemale.bsky.social/post/3mi264ootpj22 2026-03-29 05:15:56+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mi6fe3r6es2g...
CVE-2026-0394
creationtimestamp| type| source ---|---|--- 2026-03-27 12:13:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi23qsvkva2g...
CVE-2026-27857
creationtimestamp| type| source ---|---|--- 2026-03-27 12:10:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mi23lwink725 2026-07-23 14:01:23+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mrcysickuj23...
yggdrasil-worker-package-manager security update
An update is available for yggdrasil-worker-package-manager. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list yggdrasil-worker-package-manager is a simple packag...
Security update for python311
This update for python311 fixes the following issues: Update to python 3.11.15: CVE-2025-6075: quadratic complexity in os.path.expandvars bsc1252974. CVE-2025-11468: header injection with carefully crafted inputs bsc1257029. CVE-2025-12084: quadratic complexity in xml.minidom node ID cache cleari...
CVE-2026-33433
creationtimestamp| type| source ---|---|--- 2026-03-27 10:29:14+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-qr99-7898-vr7c 2026-03-27 15:20:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mi2g6xmnl22z 2026-04-03 19:24:00+00:00|...
CVE-2026-32695
creationtimestamp| type| source ---|---|--- 2026-03-27 09:47:29+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-67jx-r9pv-98rj 2026-03-27 15:20:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mi2g6xmnl22z 2026-03-27 16:47:48+00:00|...
CVE-2026-34353
creationtimestamp| type| source ---|---|--- 2026-03-27 08:07:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhznyukgbw2g 2026-03-31 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0386/...
Interpretation Conflict
github.com/traefik/traefik is vulnerable to Interpretation Conflict. The vulnerability is due to improper path normalization when handling Path, PathPrefix, or PathRegex matchers, which allows an attacker to use URL-encoded characters to bypass middleware and access unintended backend services...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to insufficient validation of user-supplied media URLs in the BedrockProxyChatModel function. An attacker can cause the server to send HTTP requests to unintended internal or external destinations by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to insufficient validation of user-supplied media URLs in the BedrockProxyChatModel function. An attacker can cause the server to send HTTP requests to unintended internal or external destinations by...
CVE-2026-3112
creationtimestamp| type| source ---|---|--- 2026-03-27 03:00:09+00:00| seen| https://nvd.nist.gov/vuln/detail/CVE-2026-4274...
CVE-2026-32669
creationtimestamp| type| source ---|---|--- 2026-03-27 03:00:00+00:00| seen| https://jvn.jp/en/jp/JVN83788689/ 2026-03-27 07:18:31+00:00| seen| Telegram/tQ8akL20JB-7ffGjDDpJsYVoTg18MfzS3yyGF6GBW7nNPwo 2026-03-27 08:41:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhzpvukoo22t...
CVE-2026-4907
CVE-2026-4907 affects Page-Replica Page Replica (Endpoint sitemap) where the function sitemap.fetch in /sitemap is vulnerable to server-side request forgery via manipulation of the url argument. This can be exploited remotely and there is reference to a publicly available exploit. The product use...
CVE-2026-4902
creationtimestamp| type| source ---|---|--- 2026-03-27 00:51:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhyvmusmez2d 2026-03-27 01:18:44+00:00| published-proof-of-concept| Telegram/iwwl46KpLYwipkJFr9bJW43ngNWdoc7X8GY9RAN-oHOG28 2026-03-31 03:00:15+00:00| seen|...