112043 matches found
PT-2026-51002
Name of the Vulnerable Software and Affected Versions PhpWeasyPrint versions prior to 2.6.0 Description PhpWeasyPrint is a PHP library used for generating PDFs from HTML pages or URLs. The library fetches content of option values server-side using the file get contents function when a value is...
PT-2026-51010
Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description A flaw exists in the GitHub webhook integration where the controller stores the pull request.statuses url value from a pull request webhook payload without validating if it points to a trusted...
PT-2026-50946
Name of the Vulnerable Software and Affected Versions GridTime 3000 versions 1.0r0.03 through 1.1r0.0 Description The GridTime 3000 GNSS Time Server leaks the access token within the URL parameters of certain endpoints. Recommendations Update GridTime 3000 versions 1.0r0.03 through 1.1r0.0 to a...
GHSA-5739-39V2-5754
creationtimestamp| type| source ---|---|--- 2026-06-18 22:41:42+00:00| seen| https://gist.github.com/alon710/c128a0f63af7d1e750d123d65278758d...
CVE-2026-8100
Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing. In certain scenarios, an authenticated request may bypass...
CVE-2026-8100
Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing. In certain scenarios, an authenticated request may bypass...
GHSA-GFJ5-979R-92PW
creationtimestamp| type| source ---|---|--- 2026-06-18 20:11:22+00:00| seen| https://gist.github.com/alon710/ddadbe26c2841109bcde2cf3e1d364b2 2026-06-18 20:22:11+00:00| seen| https://gist.github.com/alon710/fd355e480f025edd956fae7107a02df9...
CVE-2026-11982
creationtimestamp| type| source ---|---|--- 2026-06-18 18:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moli5atuno2s...
CVE-2026-55237
creationtimestamp| type| source ---|---|--- 2026-06-18 18:26:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molhcfckmw22...
GHSA-WM69-2PC3-RMMF Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)
Summary The Docker API server applied its SSRF destination check validateurldestination on the non-streaming /crawl path but not on the streaming path. handlestreamcrawlrequest passed seed URLs straight to the crawler with no destination validation. A remote, unauthenticated client could call POS...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-46580
creationtimestamp| type| source ---|---|--- 2026-06-18 17:23:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moldrmjype2w...
CVE-2026-56012
creationtimestamp| type| source ---|---|--- 2026-06-18 17:13:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mold7plwda23 2026-06-28 10:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpdqknsadc2c...
CVE-2026-40733
creationtimestamp| type| source ---|---|--- 2026-06-18 17:05:45+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3molcrxci6i26...
MAL-2026-6133 Malicious code in panrouter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd8aaf176011a764d660ee547645c34815e959d39087519cd187c1ac1af2d53 panrouter is advertised as a 'Claude Code router' but on default invocation panrouter with no arguments it a installs and rewrites the user's Claude...
CVE-2025-58175
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses ENTITYRESOLUTIONALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery SSRF. This vulnerability requires that GeoServer i...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
MAL-2026-6132 Malicious code in metavu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc05e6833390f96b1a53f5d1612e613436e5002673da2f7a8c1e8e9f9f41c525 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects hostname, platform, architecture, home...
CVE-2025-58175
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses ENTITYRESOLUTIONALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery SSRF. This vulnerability requires that GeoServer i...
CVE-2025-58175
CVE-2025-58175 affects GeoServer prior to 2.26.4 and 2.27.3. When GeoServer is configured to use a proxy base URL and ENTITY_RESOLUTION_ALLOWLIST, an unauthenticated Server-Side Request Forgery (SSRF) can be triggered. The issue only affects installations where the proxy base URL lacks a URL path...