CVE-2025-13855

creationtimestamp| type| source ---|---|--- 2026-04-01 03:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifp7aucs22m 2026-04-01 03:17:49+00:00| published-proof-of-concept| Telegram/rQGGJNosiE90GfC4CPODN8OMH2HUk0rxa4zVhsu5hB7e0 2026-04-03 14:40:10+00:00| seen|...

CVE-2026-5236

creationtimestamp| type| source ---|---|--- 2026-04-01 02:43:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifoayfszk2i...

CVE-2026-34553

creationtimestamp| type| source ---|---|--- 2026-04-01 02:16:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mifmqhjem52d...

CVE-2026-34825

creationtimestamp| type| source ---|---|--- 2026-04-01 01:33:31+00:00| published-proof-of-concept| https://github.com/nocobase/nocobase/security/advisories/GHSA-vx58-fwwq-5g8j 2026-04-02 20:52:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mik3ka64352d 2026-04-02 22:22:55+00:00|...

PT-2026-29518

A reflected cross-site scripting XSS vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered...

Payload 路径遍历漏洞

Payload is a headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. Versions of Payload prior to 3.78.0 contained a path traversal vulnerability. This vulnerability stemmed from the client-side upload signature URL endpoint not properly cleaning file names,...

TencentOS Server 3: git-lfs (TSSA-2026:0203)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0203 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Medium: golist

Issue Overview: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which t...

PT-2026-29830

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.95 Description PraisonAI's FileTools.download file function does not validate the url parameter before passing it to httpx.stream with follow redirects=True. This allows an attacker controlling the URL to access...

Amazon Linux 2023 : golist (ALAS2023-2026-1513)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1513 advisory. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. CVE-2026-25679 On Unix platforms, when listing the contents of a directory using File.ReadDir or...

ALSA-2026:6383 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...

RHEL 10 : grafana (RHSA-2026:6344)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:6344 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/url: Incorrect...

Oracle Linux 9 : python3.11 (ELSA-2026-6286)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-6286 advisory. 3.11.13-5.2.0.1 - Remove upstream URL reference Orabug: 36073032 3.11.13-5.2 - Security fix for CVE-2026-4519 Resolves: RHEL-158050 Tenable has extracted the...

ALSA-2026:6388 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For...

ALSA-2026:6382 Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper handling of IPv6 special-use address ranges in the src/shared/net/ip.ts and src/infra/net/ssrf. components. An attacker can access internal o...

CVE-2026-34222

creationtimestamp| type| source ---|---|--- 2026-03-31 23:58:42+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-7429-hxcv-268m 2026-04-02 06:21:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miikujwojm2c 2026-04-03...

CLSA-2026-1774996482 golang: Fix of CVE-2026-25679

CVE-2026-25679: fix insufficient validation of host/authority in url.Parse that allowed invalid URLs; strengthen parsing and reject malformed host and authority components - fix-smtp-test-expired-cert: fix expired TLS test certificate in net/smtp tests; replace with upstream long-lived cert...

CVE-2026-34366

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifvvsbkbx2x 2026-04-08 02:20:09+00:00| seen|...

CVE-2026-34367

creationtimestamp| type| source ---|---|--- 2026-03-31 23:20:06+00:00| published-proof-of-concept| Telegram/nmybyhyW9j--U7tziXdh4Y31RLU4faF2Hhhi6Dlcxk1tj2s 2026-04-01 05:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mifvvyxjwx2x...