112846 matches found
CVE-2026-20994
URL redirection in Samsung Account prior to version 15.5.01.1 allows local attackers to potentially get access token...
CVE-2026-31889
Shopware is an open commerce platform. Prior to 6.6.10.15 and 6.7.8.1, a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. The legacy app registration flow used HMAC‑based...
CVE-2026-2233
creationtimestamp| type| source ---|---|--- 2026-03-26 14:47:35+00:00| seen| https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mhxtvifkikt2...
CVE-2026-27876
creationtimestamp| type| source ---|---|--- 2026-03-26 14:40:27+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mhxtisjcsf26 2026-03-26 19:34:03+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/grafana-security-advisory-av26-285 2026-03-27 17:22:21+00:00| seen|...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-4809
creationtimestamp| type| source ---|---|--- 2026-03-26 14:03:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxrgxrhl225 2026-03-26 21:00:18+00:00| seen| https://infosec.exchange/users/offseq/statuses/116297486638382284 2026-03-26 21:00:19+00:00| seen|...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
EUVD-2026-13897
The Angular SSR is a server-rise rendering tool for Angular applications. Versions on the 22.x branch prior to 22.0.0-next.2, the 21.x branch prior to 21.2.3, and the 20.x branch prior to 20.3.21 have an Open Redirect vulnerability in @angular/ssr due to an incomplete fix for CVE-2026-27738. Whil...
CVE-2026-33397
The CVE concerns Angular SSR bottleneck/open-redirect in @angular/ssr. Affected series: 22.x before 22.0.0-next.2, 21.x before 21.2.3, and 20.x before 20.3.21, with a patch included in 22.0.0-next.2, 21.2.3, and 20.3.21. Root cause: incomplete fix for CVE-2026-27738 where a single backslash in X-...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
Denial Of Service (DoS)
github.com/sigstore/fulcio is vulnerable to Denial of Service DoS. The vulnerability is due to inefficient handling of untrusted input in the extractIssuerURL function, which allows an attacker to supply a token with excessive period characters to trigger high memory allocations and degrade servi...
EUVD-2026-16142
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery SSRF by manipulating the clientsessionhost parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host...
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery SSRF by manipulating the clientsessionhost parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host...
CVE-2026-4845
creationtimestamp| type| source ---|---|--- 2026-03-26 09:23:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxbry4jca2n...
CVE-2026-4860
creationtimestamp| type| source ---|---|--- 2026-03-26 09:15:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxbdab5jt2i...
CVE-2026-4247
creationtimestamp| type| source ---|---|--- 2026-03-26 09:08:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxaxo55sy2t 2026-03-27 00:01:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhystcceec2r 2026-03-27 00:01:30+00:00| seen|...
CVE-2026-1890
creationtimestamp| type| source ---|---|--- 2026-03-26 09:06:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhxaucihd522 2026-07-02 15:00:03+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-1890.yaml 2026-07-03...
CVE-2026-4874
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery SSRF by manipulating the clientsessionhost parameter during refresh token requests. This occurs when a Keycloak client is configured to use the backchannel.logout.url with the application.session.host...