116226 matches found
PYSEC-2026-3622 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Summary If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
GHSA-3F7W-8RR8-F37F
creationtimestamp| type| source ---|---|--- 2026-08-04 08:31:39+00:00| seen| https://gist.github.com/alon710/e29226c330282c9416a9859028fe2877 2026-08-17 15:00:04+00:00| seen| https://t.me/bdufstecru/3388 2026-08-18 00:00:28+00:00| published-proof-of-concept| https://t.me/bdufstecru/3388...
CVE-2026-16296
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...
CVE-2026-39932
creationtimestamp| type| source ---|---|--- 2026-08-04 06:06:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msadtmns5w2m...
CVE-2026-69085
creationtimestamp| type| source ---|---|--- 2026-08-04 06:02:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msadmgspwc2o...
CVE-2026-16296
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...
EUVD-2026-52598
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...
CVE-2026-16293
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...
EUVD-2026-52588
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...
CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
EUVD-2026-52581
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
GHSA-MQ44-7P77-Q5H7
creationtimestamp| type| source ---|---|--- 2026-08-04 04:31:10+00:00| seen| https://gist.github.com/alon710/8b85a9db45c3273615bc588dcd240ceb...
CVE-2026-59881
creationtimestamp| type| source ---|---|--- 2026-08-04 04:31:09+00:00| seen| https://gist.github.com/alon710/8b85a9db45c3273615bc588dcd240ceb...
CVE-2026-18721
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
CVE-2026-10849
creationtimestamp| type| source ---|---|--- 2026-08-04 03:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msa36ikf3x2c 2026-08-10 02:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msp2xho7xz2o...
CVE-2026-18721 kalcaddle kodbox SSO API Login apiLogin redirect
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
EUVD-2026-52570
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
