BIT-AIRFLOW-2026-40961 Apache Airflow: Open Redirect Bypass Vulnerability

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the issafeurl check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-dept...

CVE-2026-11293

creationtimestamp| type| source ---|---|--- 2026-06-05 02:34:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnj42cy6ii25 2026-06-05 13:24:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/116697713800926918 2026-06-06 08:00:28+00:00| seen|...

CVE-2025-8873

creationtimestamp| type| source ---|---|--- 2026-06-05 00:01:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnitj56uzy2r...

RockyLinux 10 : osbuild-composer (RLSA-2026:22450)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22450 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

PT-2026-47032

Name of the Vulnerable Software and Affected Versions WP Captcha PRO versions prior to 5.39 Description The plugin is susceptible to arbitrary file upload, which can lead to remote code execution. The issue stems from a flawed capability check in the save ajax function within the licensing module...

PT-2026-46927

Name of the Vulnerable Software and Affected Versions Samsung Members versions prior to 5.8.01.5 Description Improper input validation allows local attackers to access arbitrary URLs and launch arbitrary activities using Samsung Members privileges. Recommendations Update to version 5.8.01.5 or...

RockyLinux 10 : git-lfs (RLSA-2026:19133)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19133 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the roo...

CVE-2026-42547

creationtimestamp| type| source ---|---|--- 2026-06-04 23:16:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mniqyn4crz2g...

CVE-2026-42329

creationtimestamp| type| source ---|---|--- 2026-06-04 22:57:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnipvx2imz2h...

CVE-2026-5066

creationtimestamp| type| source ---|---|--- 2026-06-04 22:42:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnip2hi5672f...

CVE-2026-48522

A flaw was found in PyJWT, a JSON Web Token implementation in Python. The PyJWKClient component, prior to version 2.13.0, directly passes its Uniform Resource Identifier URI argument to urllib.request.urlopen. This allows a remote attacker, by influencing the application's jku URL ingestion path,...

GHSA-GQ96-5PFX-F4VC Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Summary The /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against private/reserved ranges via FileUrlValidator, the linkURL flow only...

CVE-2026-48040

creationtimestamp| type| source ---|---|--- 2026-06-04 19:29:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mniecjvsyh2f...

CVE-2026-50292

creationtimestamp| type| source ---|---|--- 2026-06-04 19:14:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnidhojmn72x 2026-06-11 12:18:10+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mnz7hachms2l 2026-06-11 12:18:11+00:00| seen|...

CVE-2026-7774

creationtimestamp| type| source ---|---|--- 2026-06-04 16:25:15+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnhzymng362i 2026-06-05 13:35:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnkaxtlnnt2f...

Exploit for CVE-2026-8732

CVE-2026-8732 – WordPress WP Maps Pro Exploit Unauthenticat...

CVE-2026-43986

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public /image/ route that resolves attacker-controlled entries from imagehashlookup and replays them through the same server-side image fetch logic used by authenticated image proxying...

PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation

A flaw was found in PHP, specifically within the PHP-FPM status page. Due to improper sanitation of user data, a remote attacker can craft a malicious URL. When a user views the PHP-FPM status page with this crafted URL, it can lead to the execution of arbitrary JavaScript code Cross-Site Scripti...

CVE-2026-10809

creationtimestamp| type| source ---|---|--- 2026-06-04 15:34:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnhx5xhi3a2g...

CVE-2026-45739

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...