112077 matches found
EUVD-2026-36367
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly...
CVE-2026-42846 ClipBucket: Remote Play URL Command Injection
ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - 140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly...
CVE-2026-45175
creationtimestamp| type| source ---|---|--- 2026-06-11 22:19:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2b2ibw7o23...
CVE-2026-34694
creationtimestamp| type| source ---|---|--- 2026-06-11 22:18:15+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mo2aybw3qi2d...
CVE-2026-53812
creationtimestamp| type| source ---|---|--- 2026-06-11 22:13:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2ap2utjj23 2026-06-14 15:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3moazvwvogl2d...
CVE-2026-53781
Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to cause disk exhaustion by serving media responses that bypass the enforced size limit through missing or misreported Content-Length headers, chunked transfer encoding, or failed HEAD requests...
CVE-2026-53782 Summarize < 0.17.0 SSRF via podcast:transcript URL fetch
Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying...
CVE-2026-53782 Summarize < 0.17.0 SSRF via podcast:transcript URL fetch
Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying...
CVE-2026-47170 Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint
Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port...
CVE-2026-47170
Garlic-Hub is affected by a CVE-2026-47170 SSRF in the uploadFromUrl endpoint. Prior to version 1.1 , authenticated users could cause the server to issue arbitrary HTTP requests to internal services, enabling internal port scanning, service fingerprinting, and retrieval of internal HTTP responses...
CVE-2026-47170 Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint
Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port...
EUVD-2026-36288
Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port...
CVE-2026-12031
creationtimestamp| type| source ---|---|--- 2026-06-11 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260612 2026-06-12 04:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2u4ktdqu2y 2026-06-12 05:14:42+00:00|...
CVE-2026-12028
creationtimestamp| type| source ---|---|--- 2026-06-11 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260612 2026-06-12 03:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2qrduutc2y 2026-06-12 05:41:40+00:00|...
CVE-2026-50629
creationtimestamp| type| source ---|---|--- 2026-06-11 17:41:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnzrjdlhjm25...
CVE-2026-50630
creationtimestamp| type| source ---|---|--- 2026-06-11 17:38:07+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnzrdeb7n62w...
CVE-2026-52750
Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click...
CVE-2026-48998
creationtimestamp| type| source ---|---|--- 2026-06-11 14:32:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnzgxuuio72w...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...