122575 matches found
CVE-2026-16296
The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...
EUVD-2026-52588
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...
EUVD-2026-52581
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...
GHSA-MQ44-7P77-Q5H7
creationtimestamp| type| source ---|---|--- 2026-08-04 04:31:10+00:00| seen| https://gist.github.com/alon710/8b85a9db45c3273615bc588dcd240ceb...
CVE-2026-59881
creationtimestamp| type| source ---|---|--- 2026-08-04 04:31:09+00:00| seen| https://gist.github.com/alon710/8b85a9db45c3273615bc588dcd240ceb...
CVE-2026-18721
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
CVE-2026-10849
creationtimestamp| type| source ---|---|--- 2026-08-04 03:31:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msa36ikf3x2c 2026-08-10 02:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msp2xho7xz2o...
CVE-2026-18721 kalcaddle kodbox SSO API Login apiLogin redirect
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
EUVD-2026-52570
A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown processing of the file /user/sso/apiLogin of the component SSO API Login. The manipulation of the argument callbackUrl leads to open redirect. The attack can be initiated remotely. The exploit has be...
Exploit for CVE-2026-21020
--- CVE-2026-21020 – Protobuf Message Parsing Polymorphic De...
CVE-2026-62354
creationtimestamp| type| source ---|---|--- 2026-08-04 01:52:04+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3ms7vng7zoz24...
Exploit for Improper Input Validation in Google Chrome
--- CVE-2026-11120 – Command Injection via Git URL in CI/CD...
PT-2026-73974
TuxCare rebuilt base64-url to address 1 CVE. Fixed in 1.2.1-tuxcare.1...
CVE-2026-52370
A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...
CVE-2025-29296
H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...
PT-2026-67844
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description An authenticated attacker can bypass URL validation to perform a DNS rebinding attack. The software validates hostnames by resolving them once to reject private, loopback, and link-local addresse...
PT-2026-67920
Summary The GET /api/v1/upsert-history endpoint returns the entire server-wide upsert history response size 100MB instead of being scoped to the requesting user/tenant/workspace. The response includes sensitive configuration data e.g., Vector Store settings such as Qdrant Server URL and collectio...
PT-2026-67754
Name of the Vulnerable Software and Affected Versions hermes-agent versions prior to 0.16.1 Description A flaw in the xAI Image Generation Provider component allows for remote server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended...