116220 matches found
CVE-2026-71190
creationtimestamp| type| source ---|---|--- 2026-08-05 17:40:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/f3qqd57e5e2xb...
EUVD-2026-53568
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...
CVE-2026-9081 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...
CVE-2026-9081
IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...
CVE-2026-20268
creationtimestamp| type| source ---|---|--- 2026-08-05 17:29:21+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117044082167274064 2026-08-06 05:17:07+00:00| seen| https://www.hkcert.org/security-bulletin/cisco-products-multiple-vulnerabilities20260806 2026-08-06 13:10:12+00:00| seen|...
CVE-2026-70608 Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because...
CVE-2026-17617
IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...
CVE-2026-17617
IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...
CVE-2026-15587
creationtimestamp| type| source ---|---|--- 2026-08-05 17:12:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdzjgf4672b...
CVE-2026-71201
creationtimestamp| type| source ---|---|--- 2026-08-05 16:32:14+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3r2rzs5rcn4ns...
CVE-2026-17617 Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator
IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...
keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...
CVE-2026-70606
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...
GHSA-R4W5-6PFG-JXP5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...
CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...
CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...
EUVD-2026-53430
A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...
CVE-2026-48911
creationtimestamp| type| source ---|---|--- 2026-08-05 15:25:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/4ygjgczwvv462...
CVE-2026-17506
The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...