CVE-2026-16117: Improper Input Validation

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3104-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3104-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client...

CVE-2026-54490

creationtimestamp| type| source ---|---|--- 2026-07-17 23:53:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqux4fm3a62g...

CVE-2026-54242

creationtimestamp| type| source ---|---|--- 2026-07-17 23:50:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquwvuatdz2b...

CVE-2026-44739

creationtimestamp| type| source ---|---|--- 2026-07-17 22:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquroboa4d2j 2026-07-18 17:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwqjbv3ri2g 2026-07-18 23:04:11+00:00| seen|...

CVE-2026-8056

creationtimestamp| type| source ---|---|--- 2026-07-17 21:56:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquql4zdit2a 2026-07-18 14:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwghwzbjw23 2026-07-21 09:37:07+00:00| seen|...

CVE-2026-54244

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A...

CVE-2026-16074

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-54159

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-15091

creationtimestamp| type| source ---|---|--- 2026-07-17 20:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulfbhtkk2j 2026-07-17 21:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquq7kpqwz2g 2026-07-18 17:01:21+00:00| seen|...

EUVD-2026-45320

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly...

CVE-2026-54242 Statamic: Server-Side Request Forgery via Glide (DNS rebinding)

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly...

EUVD-2026-45319

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A...

CVE-2026-15322

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs...

CVE-2026-16074 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-16074

CVE-2026-16074 affects AstrBot up to version 4.25.2. The vulnerability lies in the function update_plugin/update_all_plugins (file astrbot/dashboard/routes/plugin.py) where manipulation of the arguments download_url/download_urls/proxy enables server-side request forgery (SSRF). Exploitation may ...

EUVD-2026-45315

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-7667

creationtimestamp| type| source ---|---|--- 2026-07-17 19:51:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqujlirgex2i 2026-07-18 15:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwjtcd3jt2f 2026-07-21 10:07:06+00:00| seen|...

GO-2026-5956 OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect in github.com/openrundev/openrun

OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect in github.com/openrundev/openrun...

GO-2026-5964 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel

SiYuan: Path Traversal via Double URL Encoding in /assets/path publish mode arbitrary file─read, Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel...