EUVD-2026-39605

A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input t...

CVE-2017-14913

creationtimestamp| type| source ---|---|--- 2026-06-26 00:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp5nltqbop2r...

PT-2026-52978

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.43 Kestra versions prior to 1.3.19 Description An authenticated user can perform a path traversal attack to read arbitrary files on the host filesystem that the process has access to, such as /etc/passwd or mounted...

SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2626-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2626-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments...

AlmaLinux 10 : buildah (ALSA-2026:29195)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:29195 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

PT-2026-52849

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.9 Description A Server-Side Request Forgery SSRF issue exists in the image import functionality. Authenticated users possessing the can create images entitlement can interact with internal network...

RockyLinux 9 : runc (RLSA-2026:29702)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:29702 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient...

CVE-2026-56768

creationtimestamp| type| source ---|---|--- 2026-06-25 23:39:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5m2eudfs2p...

CVE-2026-55958

creationtimestamp| type| source ---|---|--- 2026-06-25 23:24:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5l7iyoj72k 2026-07-18 16:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqwp6dyokg2m...

CVE-2026-56767

creationtimestamp| type| source ---|---|--- 2026-06-25 23:08:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5kc6oyzd27...

CVE-2026-57700

creationtimestamp| type| source ---|---|--- 2026-06-25 22:55:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5jlh6z472w...

GO-2026-5571 OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu...

GO-2026-5535 Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor

Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor...

GO-2026-5603 Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation in github.com/lin-snow/ech0

Ech0 has SSRF via DNS Resolution Bypass in Webhook URL Validation in github.com/lin-snow/ech0. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

GO-2026-5480 Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer

Portainer: JWT accepted in URL query leaks tokens to logs and referers in github.com/portainer/portainer. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2026-5436 Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave

Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin in github.com/julien040/anyquery/plugins/brave...

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this...

CVE-2026-6330

creationtimestamp| type| source ---|---|--- 2026-06-25 22:25:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hvwozge27...

CVE-2026-11800

creationtimestamp| type| source ---|---|--- 2026-06-25 22:17:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp5hhhr7qa2r 2026-06-29 13:15:15+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpgkzuo7ml25 2026-07-01 02:46:32+00:00| seen|...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the improper handling of user-supplied URLs in the acmeurl parameter, lack of access control in the certificate key-fetch process, and...