122644 matches found
CVE-2026-46998: URL Redirection to Untrusted Site
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...
CVE-2026-47015: URL Redirection to Untrusted Site
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: PIA Core Technology. The supported version that is affected is 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...
CVE-2026-47051: URL Redirection to Untrusted Site
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Security. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...
CVE-2026-60467: URL Redirection to Untrusted Site
Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebCenter Content:...
CVE-2026-47026: URL Redirection to Untrusted Site
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: OpenSearch Dashboards. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...
CVE-2026-47048: URL Redirection to Untrusted Site
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Security. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...
PT-2026-63290
Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description The software contains two Server-Side Request Forgery SSRF issues. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location, potentially accessing...
PT-2026-63307
Name of the Vulnerable Software and Affected Versions Gitea versions 1.26.4 and earlier Description The restore-repo CLI command fails to properly validate the Head.CloneURL field when parsing pull request.yml from a repository dump. The safety check function CheckAndEnsureSafePR is called with a...
CVE-2026-47045: URL Redirection to Untrusted Site
Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows high privileged attacker having None privilege with network access via Oracle Net to compromise JDBC. Successf...
The vulnerability of the URL processor for web interfaces in the microprogramming software for D-Link DNS-320 network storage devices allows a perpetrator to cause a service failure.
The vulnerability of the URL processor in the web interface of the D-Link DNS-320 network storage microprogramming system is related to errors in access control when processing the File parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions...
CVE-2026-57495
creationtimestamp| type| source ---|---|--- 2026-07-20 23:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4icrfnis2e...
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslash were not recognized as internal paths, so the handler would echo the raw path back...
CVE-2026-64651
creationtimestamp| type| source ---|---|--- 2026-07-20 22:40:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4eghjh6n2i...
CVE-2026-44509
creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4e5isavb2q...
CVE-2026-64626
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...
GHSA-G6XQ-892H-64W3 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...
CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...
