PT-2026-58962

Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access...

SIP Sustainable Irrigation Platform 5.x (nr-url) Blind SSRF

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

CVE-2026-45066: Incomplete List of Disallowed Inputs

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...

PT-2026-58068

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0 Description An issue exists where the Caldav::connect to server function in application/controllers/Caldav.php processes the caldav url variable without validating the scheme or host. This allows an...

Apache Tomcat 10.1.0.M1 < 10.1.57 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.57. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.57security-10 advisory. - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to...

Apache Tomcat 11.0.0.M1 < 11.0.24 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.24. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.24security-11 advisory. - Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to...

EulerOS 2.0 SP10 : golang (EulerOS-SA-2026-2651)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust...

vitest: Vitest: Arbitrary code execution via crafted browser-runner URL

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the...

CVE-2026-55475

creationtimestamp| type| source ---|---|--- 2026-07-13 23:24:09+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktlkikqr2d...

CVE-2026-55404

creationtimestamp| type| source ---|---|--- 2026-07-13 23:21:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqktfz7kmj2d 2026-07-14 08:07:20+00:00| seen| https://gist.github.com/akib-h/a603a4aaf4aab24ac683c30e9a2ad670 2026-07-16 16:25:05+00:00| seen|...

CVE-2026-62195

creationtimestamp| type| source ---|---|--- 2026-07-13 23:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkt4djxzu2i 2026-07-15 09:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqoemwbh6j2f...

CVE-2026-62199

creationtimestamp| type| source ---|---|--- 2026-07-13 22:56:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrznklv22l 2026-07-15 10:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqohy7pg2g26...

CVE-2026-61458

creationtimestamp| type| source ---|---|--- 2026-07-13 22:50:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkrqbq6nf2g...

Server-side Request Forgery (SSRF)

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the URL fetch logic in the scraping loaders and website scraping tools, including DocsSiteLoader, DOCXLoader, PDFLoader, loadfromurl,...

CVE-2026-57800

creationtimestamp| type| source ---|---|--- 2026-07-13 22:18:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkpvxla5u2d 2026-07-16 08:11:51+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqryzkfi72p...

CVE-2026-62242

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-15595

creationtimestamp| type| source ---|---|--- 2026-07-13 22:15:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkpr2dip426...

CVE-2026-58410

creationtimestamp| type| source ---|---|--- 2026-07-13 22:01:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqkoxhvhd42i...

CVE-2026-12536

creationtimestamp| type| source ---|---|--- 2026-07-13 21:41:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqknu2mb5q2x...

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...