CVE-2026-45738

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...

CVE-2026-20156

creationtimestamp| type| source ---|---|--- 2026-07-15 19:39:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphydbcrh2h 2026-07-16 00:22:54+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116926799807904548 2026-07-16 13:00:30+00:00| seen|...

CVE-2026-40501

creationtimestamp| type| source ---|---|--- 2026-07-15 19:30:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqphhoez2b2u...

CVE-2026-49987

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection th...

CVE-2026-20296

creationtimestamp| type| source ---|---|--- 2026-07-15 19:10:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpgdzh2ib22 2026-07-16 02:11:53+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mqq5vdvydd2i 2026-07-16 06:26:56+00:00| seen|...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the cleanUsername process. An attacker can gain unauthorized access to another user's files by registering a username that normalizes to the same home directory as an existin...

Koel: Full-read SSRF via podcast enclosure URL: isPublicHost() filter_var guard does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6-transition wrappers of internal IPv4

Summary Koel's outbound-URL guard App\Helpers\Network::isPublicHost classifies an IP as "public" using PHP's filtervar$ip, FILTERVALIDATEIP, FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE. That flag set does not recognise IPv6 transition-address forms that embed a private/loopback/link-local IPv4:...

Koel: Server-Side Request Forgery (SSRF) in radio station creation due to missing validation bail

Summary Koel v9.5.0 contains a Server-Side Request Forgery SSRF vulnerability in the radio station creation endpoint POST /api/radio/stations. The url field validation rules are declared without the bail keyword, so the HasAudioContentType rule — which issues HTTP requests to the supplied URL —...

CVE-2026-49987

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection th...

Server-side Request Forgery (SSRF)

Overview phanan/koel is a personal audio streaming service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the createPodcastChannel.view endpoint and the PodcastService::getStreamableUrl process. An attacker can cause the backend to make arbitrary HTTP...

CVE-2026-54563

creationtimestamp| type| source ---|---|--- 2026-07-15 17:17:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp7zq7njw22 2026-08-26 16:35:10+00:00| published-proof-of-concept| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w5fv-7x5q-g8qp...

GHSA-6P96-CFG5-4VHP Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Summary Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel's radio streaming feature to make the server...

Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Summary Koel v9.6.0 validates radio station URLs on the regular web API, but the Subsonic-compatible radio endpoints do not apply the same SSRF protections. An authenticated user can create or update a radio station with a private URL and then use Koel's radio streaming feature to make the server...

GHSA-W79M-F3JX-779V Koel: Authenticated Blind SSRF via Subsonic Podcast Channel Creation

Summary Koel v9.6.0 protects the regular podcast subscription API with SafeUrl, but the Subsonic-compatible createPodcastChannel.view route does not apply the same protection. An authenticated user can supply a private URL and cause Koel to fetch it server-side during podcast parsing. This was...

CVE-2026-62175

creationtimestamp| type| source ---|---|--- 2026-07-15 16:35:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp5pcy7rq2s...

Server-side Request Forgery (SSRF)

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the file-import-from-URL. An attacker can access internal network resources by supplying the address 0.0.0.0 to th...

CVE-2026-61433

creationtimestamp| type| source ---|---|--- 2026-07-15 16:01:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqp3rzyupx2e...

BIT-DISCOURSE-2026-45788 Discourse: Secure uploads exposed by hotlinked image copying

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pullhotlinkedimages when an attacker knew the secured upload URL and the secureuploads site setting was enabled. This issue is fixed in versions 2026.6.0,...