EUVD-2026-42140

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...

CVE-2026-12277

creationtimestamp| type| source ---|---|--- 2026-07-08 00:00:21+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mq3ssrwtoa2e 2026-07-13 22:00:10+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-14 00:00:18+00:00| seen| https://t.me/GithubRedTeam/92408 2026-07-15 00:00:31+00:00|...

PT-2026-56579

Name of the Vulnerable Software and Affected Versions Plate versions 53.0.0 through 53.1.3 Description The media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation. This allows a crafted document to specify a known video...

PT-2026-56516

Name of the Vulnerable Software and Affected Versions Astro version 6.4.7 Description Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional decodeURI operation, which can...

Linux Distros Unpatched Vulnerability : CVE-2026-58469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that...

CVE-2026-55633

creationtimestamp| type| source ---|---|--- 2026-07-07 23:57:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3sn7h6ac2t...

CVE-2026-55635

creationtimestamp| type| source ---|---|--- 2026-07-07 23:52:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3sfjtcli2z...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through loadFromGitRevision. An attacker can force the loader to fetch an internal URL or read a local file by supplying a rev:path OpenAPI source whose schema contains an external $ref, even when the...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through improper authorization checks in the AddFile, EditFile, RemoveFile, and Edit handlers. An attacker can gain unauthorized access to read, modify, or delete files and project metadata across different...

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...

GHSA-26RH-24RG-J3VV Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Summary Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding...

CVE-2026-53751

creationtimestamp| type| source ---|---|--- 2026-07-07 23:33:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3rc3ggo22g...

CVE-2026-55408

creationtimestamp| type| source ---|---|--- 2026-07-07 23:24:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3qrzwq6a2z...

CVE-2020-35799

creationtimestamp| type| source ---|---|--- 2026-07-07 23:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq3ptlp6ui25...

CVE-2026-59706

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollamabaseurl parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attack...

CVE-2026-53518

creationtimestamp| type| source ---|---|--- 2026-07-07 21:48:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3lgclew62b...

CVE-2026-48950

creationtimestamp| type| source ---|---|--- 2026-07-07 21:20:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq3juz5a5l2w 2026-07-08 14:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq5claiknt2n...

DEBIAN-CVE-2026-58469

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cau...

CVE-2026-53751

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the H2 database JDBC URL validation logic can be bypassed with special Unicode characters whose case-conversion behavior differs between DataEase validation and H2 parsing, allowing attackers to smuggle dangerous...

CVE-2026-58469

GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL. Attackers can cau...