112080 matches found
CVE-2026-48998
creationtimestamp| type| source ---|---|--- 2026-06-11 14:32:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnzgxuuio72w...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token
Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | ---------------- | ----- | | Repository | pipeboard-co/meta-ads-mcp | | Affected version | ≤ 1.0.101 commit 496c988 7d14226; Versions 1.0.102–1.0.105 lack git tags, so patch status is unconfirmed. | |...
Malicious code in optional-cpu-features (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbbb7dd9c604ef3e5782d477d4db7c04c50f7906b19af03e63a540e0a44166e On npm install, both the install and postinstall lifecycle scripts run node install.js, which requires lib/sync.js. That file hardcodes BASE =...
CVE-2026-3553
creationtimestamp| type| source ---|---|--- 2026-06-11 12:45:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260612...
CVE-2026-10733
creationtimestamp| type| source ---|---|--- 2026-06-11 12:45:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxmissr2y 2026-06-11 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260612...
CVE-2026-9751
creationtimestamp| type| source ---|---|--- 2026-06-11 12:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaxhchwy25...
CVE-2026-41000
creationtimestamp| type| source ---|---|--- 2026-06-11 12:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaoi3n5f2d...
CVE-2026-40996
creationtimestamp| type| source ---|---|--- 2026-06-11 12:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaoi3n5f2d...
CVE-2026-41862
creationtimestamp| type| source ---|---|--- 2026-06-11 12:40:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnzaoi3n5f2d 2026-06-24 00:10:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moymtyjg6x2a 2026-06-24 00:16:48+00:00| seen|...
CVE-2026-49214 guzzlehttp/psr7 has CRLF Injection via URI Host Component
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did not reject ASCII control characters, whitespace, or DEL in first-party URI host components. A vulnerable flow is: First, an application accepts a user-controlled URL. Second, the URL is used to...
CVE-2026-7662
creationtimestamp| type| source ---|---|--- 2026-06-11 12:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mnz7dllzzs22...
UBUNTU-CVE-2026-9204
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server and access internal network resources...
RLSA-2026:22714 Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: golang:...
CVE-2026-9019
The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gridpropertiesborderColor' and 'gridimagesNattachmenturl' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for...