CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16117 @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for route matching, but request.url retains the original encoded form, and the prefix-rewrite step uses a literal string...

CVE-2026-16158

Affected component: @fastify/reply-from. Versions 8.3.1 up to, but not including, 12.6.4 construct an internal URL cache key by concatenating destination and source paths without a delimiter, enabling cross-upstream data access when getUpstream selects an upstream from request data. This can caus...

CVE-2026-44203

creationtimestamp| type| source ---|---|--- 2026-07-18 00:31:11+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mquz72wk7c2s...

CVE-2026-56741

creationtimestamp| type| source ---|---|--- 2026-07-18 00:19:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquyl3hgcb2a 2026-07-18 05:00:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvibaehij2c 2026-07-20 22:37:21+00:00| published-proof-of-concept|...

PT-2026-60992

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web fetch/web fetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit ha...

SUSE SLED15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3104-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3104-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client...

CVE-2026-54490

creationtimestamp| type| source ---|---|--- 2026-07-17 23:53:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqux4fm3a62g...

CVE-2026-54242

creationtimestamp| type| source ---|---|--- 2026-07-17 23:50:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquwvuatdz2b...

CVE-2026-44739

creationtimestamp| type| source ---|---|--- 2026-07-17 22:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquroboa4d2j 2026-07-18 17:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwqjbv3ri2g 2026-07-18 23:04:11+00:00| seen|...

CVE-2026-8056

creationtimestamp| type| source ---|---|--- 2026-07-17 21:56:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquql4zdit2a 2026-07-18 14:01:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwghwzbjw23 2026-07-21 09:37:07+00:00| seen|...

CVE-2026-54244

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and renders caller-supplied field values. A...

CVE-2026-16074

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-54159

PrestaShop psfacetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the psfacetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored ...

CVE-2026-15091

creationtimestamp| type| source ---|---|--- 2026-07-17 20:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulfbhtkk2j 2026-07-17 21:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquq7kpqwz2g 2026-07-18 17:01:21+00:00| seen|...

CVE-2026-54242 Statamic: Server-Side Request Forgery via Glide (DNS rebinding)

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly...

CVE-2026-15322

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs...

CVE-2026-16074 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-16074

CVE-2026-16074 affects AstrBot up to version 4.25.2. The vulnerability lies in the function update_plugin/update_all_plugins (file astrbot/dashboard/routes/plugin.py) where manipulation of the arguments download_url/download_urls/proxy enables server-side request forgery (SSRF). Exploitation may ...

EUVD-2026-45315

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...