CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

GHSA-6JXM-FV7W-RW5J

creationtimestamp| type| source ---|---|--- 2026-07-20 18:00:49+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mr3urupfyo2u...

CVE-2026-21824

creationtimestamp| type| source ---|---|--- 2026-07-20 17:35:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3tej6ryt2o...

CVE-2026-44227

RT (Rocket Tickets) is affected in versions 6.0.0 and above up to, but not including, 6.0.3, where a reflected XSS vulnerability exists in URL parameters. An attacker who can lure an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user’s browser session, with...

CVE-2026-57356

creationtimestamp| type| source ---|---|--- 2026-07-20 16:44:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3qiss5gu2n 2026-07-21 02:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4rzmvp3q2j 2026-07-21 12:44:08+00:00| seen|...

CVE-2026-32824

The CVE affects dataCycle-CORE (dataCycle data management system). Before and including version 25.07.3, a low-privileged authenticated API user could supply forwardToUrl and redirectUrl during password reset/confirmation flows, which were embedded into outgoing emails without host allowlisting. ...

CVE-2026-63429

HeyForm is an open-source form builder with a vulnerable endpoint: before 3.0.0-rc.9, POST /api/upload has no authentication, guards, form-context validation, openToken requirement, or session cookie check. Any anonymous internet user can upload various file types (up to 10 MB) and receive a perm...

CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...

CVE-2026-57350

creationtimestamp| type| source ---|---|--- 2026-07-20 15:44:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr3n5i75v72h 2026-07-21 01:44:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mr4ooe32wi2u 2026-07-21 11:44:09+00:00| seen|...

CVE-2026-64623

creationtimestamp| type| source ---|---|--- 2026-07-20 14:05:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3hmy6bbm2b...

CVE-2026-64621

creationtimestamp| type| source ---|---|--- 2026-07-20 13:55:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3h32uwig2b 2026-07-21 04:04:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr4wik2cxe2s...

CVE-2026-63739

creationtimestamp| type| source ---|---|--- 2026-07-20 13:31:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3fpfnebr2e 2026-07-23 08:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrcgomyp6o2s...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

CVE-2026-57309

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

CVE-2026-57309 Blind SQL Injection in Windu CMS

A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...

CVE-2026-58469

A flaw was found in GNU Wget. A malicious server could exploit a heap buffer underread vulnerability by providing a specially crafted Metalink document containing a URL with only whitespace characters. This could lead to memory corruption and abnormal program behavior, potentially causing a denia...

CVE-2026-15813

creationtimestamp| type| source ---|---|--- 2026-07-20 11:55:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3aexvnnd23...

CVE-2026-13147

creationtimestamp| type| source ---|---|--- 2026-07-20 08:45:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr2vq6jhwj22 2026-07-20 14:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr3ivhsis32s...

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

EUVD-2026-45898

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...