CVE-2026-10680

creationtimestamp| type| source ---|---|--- 2026-07-21 23:15:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6wt5uxig2e...

CVE-2026-60239

creationtimestamp| type| source ---|---|--- 2026-07-21 23:14:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6wqz5oek2u 2026-07-23 16:49:08+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 12:37:07+00:00| seen|...

CVE-2026-60209

creationtimestamp| type| source ---|---|--- 2026-07-21 23:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6wga6kjz2v 2026-07-23 16:48:07+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 06:07:07+00:00| seen|...

CVE-2026-60204

creationtimestamp| type| source ---|---|--- 2026-07-21 23:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6w72shx722 2026-07-23 16:47:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-29 20:07:06+00:00| seen|...

CVE-2026-60230

creationtimestamp| type| source ---|---|--- 2026-07-21 22:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6u6oskys2z 2026-07-23 16:48:57+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 04:07:07+00:00| seen|...

CVE-2026-60226

creationtimestamp| type| source ---|---|--- 2026-07-21 22:24:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6txkwoum2v 2026-07-23 16:48:47+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 02:07:07+00:00| seen|...

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

GHSA-V2HH-GCRM-F6HX fast-uri vulnerable to host confusion via literal backslash authority delimiter

Impact fast-uri v4.1.0 and earlier do not treat a literal backslash U+005C as an authority delimiter. Node's native WHATWG URL used by fetch, undici, and Node's http/https clients normalizes \ to / for special schemes http, https, ws, wss, ftp, file, so the two parsers extract different hosts fro...

CVE-2026-46989

creationtimestamp| type| source ---|---|--- 2026-07-21 22:06:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sxgxqu62j 2026-07-23 16:45:33+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 15:07:07+00:00| seen|...

CVE-2026-46983

creationtimestamp| type| source ---|---|--- 2026-07-21 22:06:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sxf46fe2e 2026-07-23 16:45:24+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...

CVE-2026-46876

creationtimestamp| type| source ---|---|--- 2026-07-21 22:02:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sqbmfcn2v 2026-07-23 16:45:05+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 10:07:07+00:00| seen|...

CVE-2026-35290

creationtimestamp| type| source ---|---|--- 2026-07-21 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6sq7map423 2026-07-23 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9 2026-07-26 09:37:06+00:00| seen|...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-8986

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station...

CVE-2026-56654

creationtimestamp| type| source ---|---|--- 2026-07-21 21:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6ppnqxbj2r 2026-07-21 22:36:25+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-683j-3ff6-hh2x...

GHSA-5GGR-2F2H-JMVM Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

CVE-2026-63764

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass

LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...

CVE-2026-63764

LMDeploy prior to 0.14.0 contains a server-side request forgery (SSRF) in the _load_http_url function of the media handler. The private-IP guard validates only the original URL; after HTTP redirects, hosts are not re-validated. An unauthenticated attacker can submit a crafted image_url to the cha...

CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...