OESA-2026-3171 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: When asking curl to use a .netrc file to find credentials and at the same time specifying a URL with a usernamewithout a password, like...

OESA-2026-3142 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Handling of URL Encodi...

CVE-2026-56191

creationtimestamp| type| source ---|---|--- 2026-07-24 00:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mre3pj76me23 2026-07-24 03:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mreee4ela22q 2026-07-24 04:30:27+00:00| seen|...

CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-16805

creationtimestamp| type| source ---|---|--- 2026-07-23 22:15:23+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971596854729313 2026-07-24 12:45:43+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-google-chrome-64 2026-07-24 13:30:23+00:00| seen|...

CVE-2026-15981

creationtimestamp| type| source ---|---|--- 2026-07-23 21:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdrcxw2hw2y 2026-07-26 10:01:16+00:00| seen| https://bsky.app/profile/suriq.io/post/3mrk4rv32bq2i 2026-07-26 15:00:28+00:00| seen|...

CVE-2026-63313 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch

9Router before 0.4.72 contains a server-side request forgery SSRF vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider Firecrawl, Jina Reader, Tavily, or Exa to fetch content. The URL is only...

CVE-2026-63313

9Router before 0.4.72 is affected by a server-side request forgery (SSRF) in the /v1/web/fetch endpoint. The endpoint accepts a user-supplied url and passes it to an external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa). Validation only checks syntactic correctness via new URL(), wi...

CVE-2026-61170

creationtimestamp| type| source ---|---|--- 2026-07-23 18:16:42+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-61072

creationtimestamp| type| source ---|---|--- 2026-07-23 17:51:46+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 14:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrflyia4e32e...

CVE-2026-60918

creationtimestamp| type| source ---|---|--- 2026-07-23 17:49:10+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60778

creationtimestamp| type| source ---|---|--- 2026-07-23 17:46:52+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60676

creationtimestamp| type| source ---|---|--- 2026-07-23 17:45:12+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-60402

creationtimestamp| type| source ---|---|--- 2026-07-23 17:15:49+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-24 18:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrfy2pkj7b2r...

CVE-2026-65906

creationtimestamp| type| source ---|---|--- 2026-07-23 17:02:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdcvtdw6i2j...

CVE-2026-61184

creationtimestamp| type| source ---|---|--- 2026-07-23 16:56:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcku3brp24 2026-07-23 18:17:10+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-29 23:07:06+00:00| seen|...

EUVD-2026-48311

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-65697 Fathom Lite 1.3.1 Stored XSS via /collect Endpoint

Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...

CVE-2026-48534

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by...

Directory Traversal

Overview postcss is a PostCSS is a tool for transforming styles with JS plugins. Affected versions of this package are vulnerable to Directory Traversal via the process function. An attacker can access arbitrary files and obtain the first 10 bytes of their contents by supplying a crafted...