122561 matches found
CVE-2026-19021
creationtimestamp| type| source ---|---|--- 2026-08-06 08:48:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/cqhoz3infbyc4...
CVE-2026-18597 Blind SSRF on Foxit PDF Services API
The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure...
EUVD-2026-53723
The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts...
CVE-2026-18325
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-70431
creationtimestamp| type| source ---|---|--- 2026-08-06 04:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msf5riptc32a...
EUVD-2026-53704
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-67869
creationtimestamp| type| source ---|---|--- 2026-08-06 00:59:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msetnyu4se2t 2026-08-06 01:56:31+00:00| seen| https://bsky.app/profile/termsofsurrender.bsky.social/post/3msewt7h35e2l...
CVE-2026-18973
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...
CVE-2026-18973
The CVE-2026-18973 entry concerns heshengtao super-agent-party (
CVE-2026-18973 heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...
EUVD-2026-53694
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...
CVE-2026-18973 heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...
IBM Langflow OSS path traversal vulnerability (CNVD-2026-32376)
IBM Langflow OSS is the open-source version of Langflow that IBM officially integrates and promotes. IBM Langflow OSS has a path traversal vulnerability. This vulnerability arises from failing to properly validate URL-encoded path traversal sequences in file names when handling MCP resources/read...
CVE-2026-64653: Improper Limitation of a Pathname to a Restricted Directory
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...
PT-2026-68764
Name of the Vulnerable Software and Affected Versions GitHub CLI gh versions prior to 2.97.0 Description Certain HTTP request URLs interpolate variable path components without percent encoding. This allows URL path metacharacters within attacker-controlled repository or resource values to redirec...
EulerOS 2.0 SP13 : mutt (EulerOS-SA-2026-3032)
According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP authcram MD5 digest.CVE-2026-43859 In mutt before 2.3.2, the imapauthgss...
PT-2026-68366
Name of the Vulnerable Software and Affected Versions heshengtao super-agent-party versions prior to 0.4.2 Description Remote attackers can trigger server-side request forgery SSRF by manipulating the url argument within the sanitize proxy url function located in the server.py file of the extensi...
EulerOS 2.0 SP13 : mutt (EulerOS-SA-2026-2982)
According to the versions of the mutt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP authcram MD5 digest.CVE-2026-43859 In mutt before 2.3.2, the imapauthgss...
CVE-2026-18597: Server-Side Request Forgery (SSRF)
The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure...
PT-2026-68508
🚨 CVE-2026-28141 - high 🚨 NextGEN Gallery = 4.2.3 - Reflected Cross-Site Scripting NextGEN Gallery through 4.2.3 reflects a URL-decoded ngg tag route value into the g... 👾 https://t.co/No4GJJJ3Dv @pdnuclei NucleiTemplates cve...