CVE-2026-57575

Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Server-Side Request Forgery SSRF vulnerability in URL preview functionality in UrlPreviewService. Due to missing network restrictions before establishing outbound connections, a remote attacker can...

CVE-2026-55476

creationtimestamp| type| source ---|---|--- 2026-07-10 20:31:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqcyku5uto2g 2026-07-11 01:07:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdhxajxvf2f...

CVE-2026-58661

creationtimestamp| type| source ---|---|--- 2026-07-10 20:21:27+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxy5ayys2x 2026-07-13 23:47:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkuvklvvh2c 2026-07-16 08:13:00+00:00| seen|...

CVE-2026-59793

creationtimestamp| type| source ---|---|--- 2026-07-10 20:17:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxrw55ea2i 2026-07-11 00:33:33+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg2wgqn22i 2026-07-11 04:37:07+00:00| seen|...

CVE-2026-55461

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url-previous from the attacker-controlled Referer header into Laravel’s intended URL session value and later uses redirect-intended... when redirectoption=back is submitted, allowing Snipe-IT to be used a...

CVE-2026-57211

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...

CVE-2026-57211 RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension plugins are enabled,...

Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL

Summary The /authorize endpoint accepts any redirecturi without validating it against AllowedOrigins. When responsetype=token or responsetype=idtoken, the server appends accesstoken, idtoken, and refreshtoken as query parameters and issues a 302 redirect to the attacker-supplied URL. An...

EUVD-2026-39122

SiYuan: Path Traversal via Double URL Encoding in /assets/path publish mode arbitrary file─read, Incomplete fix of CVE-2026-41894...

CVE-2026-15146

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...

CVE-2026-43752

creationtimestamp| type| source ---|---|--- 2026-07-10 19:04:45+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqctoyn4qp2f...

CVE-2026-5801

creationtimestamp| type| source ---|---|--- 2026-07-10 18:52:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsycg2de25 2026-07-10 20:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqcwsvtxff2d 2026-07-10 20:41:14+00:00| seen|...

CVE-2026-22660

creationtimestamp| type| source ---|---|--- 2026-07-10 18:48:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcsrjjulo27...

CVE-2026-15299

creationtimestamp| type| source ---|---|--- 2026-07-10 18:47:14+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcspog65f2c...

CVE-2026-51119

creationtimestamp| type| source ---|---|--- 2026-07-10 18:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsnl6hmo2b 2026-07-10 22:43:35+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd7wcheku2c 2026-07-11 00:51:44+00:00| seen|...

CVE-2026-51597

creationtimestamp| type| source ---|---|--- 2026-07-10 18:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcsjz26m72r 2026-07-11 00:34:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqdg3vxy2e27...

Security Bulletin: IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control (CVE-2026-9762)

Summary IBM® Db2® is vulnerable to remote code execution when jdbc url is under user control. Vulnerability Details CVEID:CVE-2026-9762 DESCRIPTION: IBM Data Server Driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control. CWE:CWE-94: Improper Control of...

CVE-2026-57736

creationtimestamp| type| source ---|---|--- 2026-07-10 18:07:16+00:00| seen| https://bsky.app/profile/martechnotes.bsky.social/post/3mqcqi72gkh2b...

CVE-2026-55671

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

EUVD-2026-42978

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...