BuildKit Git URL subdir component can cause access to restricted files

Impact Insufficient validation of Git URL fragment subdir components :, docs may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. Patches The issue has been fixed in version v0.28.1 Workarounds The issue affects...

CVE-2026-4897

creationtimestamp| type| source ---|---|--- 2026-03-26 17:47:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy5xpk5qr25 2026-03-29 11:48:45+00:00| seen| https://bsky.app/profile/concisecyber.bsky.social/post/3mi73cjshg52r 2026-04-09 12:45:08+00:00| seen|...

CVE-2026-28297

creationtimestamp| type| source ---|---|--- 2026-03-26 17:28:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4v6mpeg2z 2026-03-27 03:00:06+00:00| seen| https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28297...

CVE-2026-33732

srvx is a universal server based on web standards. Prior to version 0.11.13, a pathname parsing discrepancy in srvx's FastURL allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme e.g. file://. Starting in version 0.11.13, the...

CVE-2026-4867

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

UBUNTU-CVE-2026-4867

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

CVE-2026-4867

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

CVE-2026-26070

creationtimestamp| type| source ---|---|--- 2026-03-26 17:13:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy3zofogr2s...

CVE-2026-26072

creationtimestamp| type| source ---|---|--- 2026-03-26 17:06:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy3o4ci4y2t...

CVE-2026-22593

creationtimestamp| type| source ---|---|--- 2026-03-26 17:02:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhy3hlbpxr2i 2026-03-26 23:01:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhypierqop2w 2026-03-26 23:16:27+00:00| seen|...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the improper enforcement of access controls in the ReadAll and GetTaskAttachment processes. An attacker can gain unauthorized access to and delete file attachments across all...

srvx is vulnerable to middleware bypass via absolute URI in request line

Summary A pathname parsing discrepancy in srvx's FastURL allows middleware bypass on the Node.js adapter when a raw HTTP request uses an absolute URI with a non-standard scheme e.g. file://. Details When Node.js receives an absolute URI in the request line e.g. GET file://hehe?/internal/run...

CVE-2026-4867 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

CVE-2026-4867

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

CVE-2026-33160

Craft CMS is a content management system CMS. From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes. T...

CVE-2019-25650

creationtimestamp| type| source ---|---|--- 2026-03-26 15:16:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxvjohirv2n...

CVE-2026-4284

A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the file - yudao-module-digitalcourse/yudao-module-digitalcourse-biz/src/main/java/cn/iocoder/yudao/module/digitalcourse/util/PPTUtil.java of th...

CVE-2025-69239

Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the URL for redirecting server-side HTTP request. This issue was fixed in version 1.4.6...

CVE-2025-10461

Global file reads caused by improper URL checks in webserver in Softing Industrial Automation GmbH smartLinks on docker filesystem modules allows file access. This issue affects smartLink SW-HT: through 1.42 smartLink SW-PN: through 1.03...

CVE-2025-13219

IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...