CVE-2026-56779

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and downloadurl parameters. Attackers with default workspace USER role can...

CVE-2026-55700

creationtimestamp| type| source ---|---|--- 2026-06-25 18:08:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4zjp5xqs2o 2026-06-27 07:12:30+00:00| seen| https://gist.github.com/alon710/df5b0744014030db937f68dddaa36b9f 2026-06-29 23:02:40+00:00| seen|...

CVE-2026-55699

creationtimestamp| type| source ---|---|--- 2026-06-25 18:01:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4z57mqql2z 2026-06-27 00:35:02+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-4gxm-v5v7-fqc4 2026-06-29 23:04:39+00:00| seen|...

CVE-2025-7105

creationtimestamp| type| source ---|---|--- 2026-06-25 18:00:52+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mp4z4xmveg2a...

CVE-2024-11171

creationtimestamp| type| source ---|---|--- 2026-06-25 18:00:46+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mp4z4qzesk2h...

CVE-2026-50016

creationtimestamp| type| source ---|---|--- 2026-06-25 17:59:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4yzms5tm2j 2026-06-27 00:35:31+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-hwx4-2j3j-g496 2026-06-30 00:41:03+00:00| seen|...

CVE-2026-54679

creationtimestamp| type| source ---|---|--- 2026-06-25 17:53:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4yq3qjse2o...

CVE-2018-12972

creationtimestamp| type| source ---|---|--- 2026-06-25 17:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp4xsgtipk2h...

CVE-2026-54573

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last...

CVE-2026-9183

creationtimestamp| type| source ---|---|--- 2026-06-25 17:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mp4wmvxbmf2f...

CVE-2026-54821

creationtimestamp| type| source ---|---|--- 2026-06-25 17:07:53+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp4w67bmw227 2026-06-30 00:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mphpxmac5a25...

CVE-2026-9800

CVE-2026-9800 affects Keycloak Policy Enforcer. The issue allows any authenticated user to bypass authorization checks (roles, scopes, UMA) by leveraging the configured access-denied page path in the request URL, either as a path segment or a query parameter. Root cause described in records as an...

EUVD-2026-39471

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...

CVE-2026-56049

creationtimestamp| type| source ---|---|--- 2026-06-25 16:06:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp4sqncaw42x 2026-08-01 01:44:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrydsh5bxw2n...

CVE-2026-54573

CVE-2026-54573 affects Outline (a collaborative documentation service). Before version 1.8.0, AuthenticationHelper.canAccess uses ctx.originalUrl and extracts the target resource by splitting on “/” and taking the last segment, but does not strip the URL fragment (#). Since Koa’s router uses ctx....

CVE-2026-54573

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last...

CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last...

CVE-2026-54573 Authorization Bypass in API Key/OAuth Scopes via Path Parsing Discrepancy

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess function uses ctx.originalUrl to verify if an API key or OAuth token has the required scopes for a request. It extracts the resource by splitting the URL by / and taking the last...