111971 matches found
PYSEC-2026-497 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...
PYSEC-2026-338 FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Technical Description The OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A critical vulnerability exists in the buildurl method. When an OpenAPI...
CVE-2026-13560
Summary : CVE-2026-13560 affects Edimax EW-7478APC (firmware 1.04). The vulnerable component is the POST Request Handler’s /goform/formAccept function, where manipulating the argument submit-url enables an OS command injection . The attack is remote and the exploit has been disclosed publicly. Th...
CVE-2026-13560 Edimax EW-7478APC POST Request formAccept os command injection
A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...
CVE-2026-13560 Edimax EW-7478APC POST Request formAccept os command injection
A security vulnerability has been detected in Edimax EW-7478APC 1.04. The affected element is the function formAccept of the file /goform/formAccept of the component POST Request Handler. The manipulation of the argument submit-url leads to os command injection. The attack is possible to be carri...
MAL-2026-6592 Malicious code in maplibre-gl-vue3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815 The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects...
CVE-2026-13537
creationtimestamp| type| source ---|---|--- 2026-06-29 08:09:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfzx2zswj2a 2026-06-29 10:48:44+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgctwjk7522 2026-06-29 13:09:08+00:00| seen|...
CVE-2017-0003
creationtimestamp| type| source ---|---|--- 2026-06-29 07:54:37+00:00| seen| https://gist.github.com/tu-trinh-scale/cb28617ddc3f6adf2b7f5da89706e0f7 2026-07-26 07:02:13+00:00| seen| https://t.me/KaitNews/2468 2026-07-27 00:01:51+00:00| seen| https://t.me/KaitNews/2468 2026-08-05 20:00:04+00:00|...
CVE-2026-54815
creationtimestamp| type| source ---|---|--- 2026-06-29 07:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpfwxrmzjl2i...
CVE-2026-13543
A vulnerability was detected in Documenso up to 2.11.0. Affected by this vulnerability is an unknown functionality of the file packages/auth/server/lib/utils/handle-oauth-callback-url.ts of the component Google OAuth Login. The manipulation results in improper authentication. It is possible to...
BIT-GITLAB-2026-12635 Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with maintainer-role permissions to make requests to internal network resources through...
Malicious code in checkmarx-claude-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...
MAL-2026-6576 Malicious code in checkmarx-claude-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a16e61d88e467ada75205ee93a9339cdf2fb65f3ded068282b4d83b6cb05e9 When the CLI runs the documented npx checkmarx-claude-cache invocation pattern, bin/cli.js performs an HTTPS GET to a hardcoded URL on a lookalike ho...
CVE-2026-13540 GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery
A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/service/RepositoryCreationService.scala. Performing a manipulation of the argument url results in server-side request forgery. The attack i...
CVE-2026-54282
A flaw was found in Starlette, a lightweight Asynchronous Server Gateway Interface ASGI framework. Prior to version 1.3.0, the HTTP request path was not properly validated when reconstructing the request.url. A remote attacker could craft a malicious HTTP request path that does not begin with a...
CVE-2026-13526
creationtimestamp| type| source ---|---|--- 2026-06-29 04:13:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfmryyzdh2e...
CVE-2026-13530
creationtimestamp| type| source ---|---|--- 2026-06-29 04:09:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfmjzor3l23 2026-06-29 19:54:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphbe7zq3r2d...
CVE-2026-13519
creationtimestamp| type| source ---|---|--- 2026-06-29 03:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mpfiomtph42p 2026-06-29 04:33:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpfnv4hres27 2026-06-29 12:59:29+00:00| seen|...
CVE-2026-49991
creationtimestamp| type| source ---|---|--- 2026-06-29 01:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpfby6r6fp2x 2026-06-29 05:10:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpfpwvwcr226...