GHSA-8C25-4J27-2RV3 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...

CVE-2026-55626

creationtimestamp| type| source ---|---|--- 2026-07-20 21:16:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr47p6qwva2o...

CVE-2024-4321

creationtimestamp| type| source ---|---|--- 2026-07-20 21:09:16+00:00| seen| https://gist.github.com/tu-trinh-scale/483368fe4ec0bd6dd8b99c1e77ef59e5...

CVE-2021-24967

creationtimestamp| type| source ---|---|--- 2026-07-20 21:00:06+00:00| seen| https://t.me/crackvaultde/1054 2026-07-21 00:00:18+00:00| seen| https://t.me/crackvaultde/1054 2026-07-22 01:00:17+00:00| published-proof-of-concept| https://t.me/crackvaultde/1054...

CVE-2026-16337

creationtimestamp| type| source ---|---|--- 2026-07-20 20:46:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr45zfra2n2z...

EUVD-2026-46096

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...

CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

EUVD-2026-46082

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the getQueryParam function /public/js/main.js and was addressed in version 1.8.139 by blocking URL query keys matching the pattern proto. However, this mitigation is incomplete: i...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2024-1310

creationtimestamp| type| source ---|---|--- 2026-07-20 19:18:44+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3z57rhzd2j...

CVE-2026-63731

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

CVE-2026-63769

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, a...

CVE-2026-55645

creationtimestamp| type| source ---|---|--- 2026-07-20 19:10:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3yoxhlpl23...

CVE-2026-63769

Huginn (up to version 2022.08.18) is affected by a server-side request forgery in the fetch_url method of ScenarioImport. The vulnerability allows authenticated users to submit crafted URLs that cause arbitrary HTTP requests, enabling probing of internal networks, port enumeration via error signa...

CVE-2026-58413

creationtimestamp| type| source ---|---|--- 2026-07-20 19:00:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3y52bqdc2o...

CVE-2026-58481

creationtimestamp| type| source ---|---|--- 2026-07-20 18:47:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3xfozvk223...

CVE-2026-58482

creationtimestamp| type| source ---|---|--- 2026-07-20 18:38:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3wvh2mgm24...

CVE-2026-64207

creationtimestamp| type| source ---|---|--- 2026-07-20 18:25:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3w6tyfla2i 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-63071

creationtimestamp| type| source ---|---|--- 2026-07-20 18:19:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr3vsp3r3u25 2026-07-21 15:30:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr64tc4amt22...