122920 matches found
CVE-2026-15551
creationtimestamp| type| source ---|---|--- 2026-07-13 01:30:39+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqik6uqc3l2e 2026-07-13 03:41:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqirjanmxp2z...
MAL-2026-10217 Malicious code in dotnet-runtime-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...
CVE-2026-15514
creationtimestamp| type| source ---|---|--- 2026-07-13 00:30:19+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqigsyplnr2y 2026-07-13 04:08:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiszrfnrl2w...
CVE-2026-15507
creationtimestamp| type| source ---|---|--- 2026-07-13 00:01:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqifa5gev425 2026-07-13 20:46:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkksfgwji2z...
PT-2026-59281
A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function validate url safe of the file src/mcp url downloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The...
PT-2026-59127
Impact The URLInputHandler class in docling graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no...
PT-2026-59540
Summary PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls MentionsParser.process.... The @url: handler then performs a direct urllib.request.urlopen request to the attacker-controlled URL...
PT-2026-59539
Summary PraisonAI's spider tools URL validation can be bypassed using alternate loopback host encodings. The affected component is: text praisonaiagents/tools/spider tools.py The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled...
PT-2026-59082
Summary Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be partially bypassed because of a mismatch in URL parsing. In some malformed URLs, Python’s standard URL parser urllib and the HTTP client stack requests / urllib3 do not agree on which host is actually being targeted...
PT-2026-57851
Cross-site scripting vulnerability in phoenixframework phoenix live view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid destination!/2 and Phoenix.LiveView.Utils.valid live navigation destination!/2 functio...
PT-2026-59573
Summary PraisonAI's spider tools URL validation can be bypassed using alternate loopback host encodings. The affected component is: text praisonaiagents/tools/spider tools.py The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled...
PT-2026-59572
Summary FileTools.download file in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream with follow redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadat...
PT-2026-59582
Summary The URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current PraisonAI project uses validate url to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...
CVE-2026-41041: Improper Handling of URL Encoding (Hex Encoding)
URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue...
CVE-2026-58228: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...
PT-2026-59265
Summary The URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current project uses validate url to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...
PT-2026-59385
Summary The SafePlaywrightURLLoader implements a validate url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects 301/302 by default, an attacker...
PT-2026-59141
While testing the OAuth Proxy implementation, it was noticed that the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for this MCP server, the token is issued for the base url passed to...
PT-2026-57904
Name of the Vulnerable Software and Affected Versions CrewAI versions prior to 1.15.1 Description A server-side request forgery SSRF issue exists in the validate url function. The function performs one-shot DNS resolution and blocklist checks but returns the original URL unchanged. This allows...
PT-2026-59261
Summary A Server-Side Request Forgery SSRF vulnerability exists in LMDeploy's vision-language module. The load image function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, a...