CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...

CVE-2026-62240 CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validateurl function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...

Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

CVE-2026-58409 ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-58409 ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

CVE-2026-57814

creationtimestamp| type| source ---|---|--- 2026-07-13 19:49:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkhlro7g72a 2026-07-14 02:37:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql6g5oes52y 2026-07-16 08:09:25+00:00| seen|...

CVE-2026-14906

creationtimestamp| type| source ---|---|--- 2026-07-13 19:43:18+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqkhap3uhf2c 2026-07-15 14:15:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqovtojixm2h 2026-08-13 13:10:03+00:00| seen|...

GHSA-7XW9-549R-8JRC

creationtimestamp| type| source ---|---|--- 2026-07-13 19:42:25+00:00| seen| https://gist.github.com/alon710/e0411f3e1cdf3980cab9ce593ae8692e...

CVE-2026-57803

creationtimestamp| type| source ---|---|--- 2026-07-13 19:29:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkgiadrvj2e 2026-07-14 02:26:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql5seep2a22 2026-07-16 08:08:03+00:00| seen|...

CVE-2026-57782

creationtimestamp| type| source ---|---|--- 2026-07-13 19:28:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkgfn4yte2x...

CVE-2026-22100

creationtimestamp| type| source ---|---|--- 2026-07-13 18:50:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkecsvgau2c 2026-07-14 03:05:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mql7xs3giy2i 2026-07-16 08:06:24+00:00| seen|...

CVE-2026-49969

Vulnerability overview: Laravel-Mediable

CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

CVE-2026-49969 Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource. Attackers can craft URLs targeting...

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-58228 Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-58228

Cross-site scripting vulnerability in phoenixframework phoenixliveview allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.validdestination!/2 and Phoenix.LiveView.Utils.validlivenavigationdestination!/2 functions in...

CVE-2026-58228

Summary: CVE-2026-58228 affects phoenix_live_view (Phoenix.LiveView.Utils) and enables XSS via due to scheme validation bypass. The root cause is the internal uri_scheme/1 helper in Phoenix.LiveView.Utils that only detects schemes when the first byte is an ASCII letter; inputs starting with ASCI...