CVE-2026-10240 JeecgBoot test server-side request forgery

A vulnerability was identified in JeecgBoot up to 3.9.2. The impacted element is an unknown function of the file /airag/airagModel/test. The manipulation of the argument baseUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly...

EUVD-2026-33597

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the issafeurl check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-dept...

CVE-2026-40961 Apache Airflow: Open Redirect Bypass Vulnerability

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the issafeurl check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-dept...

CVE-2026-40961 Apache Airflow: Open Redirect Bypass Vulnerability

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the issafeurl check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin. Users are advised to upgrade to apache-airflow 3.2.2 or later. As a defense-in-dept...

CVE-2026-48189

creationtimestamp| type| source ---|---|--- 2026-06-01 07:37:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7l4o2yyv2j...

CVE-2026-48187

creationtimestamp| type| source ---|---|--- 2026-06-01 07:18:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7k24cjqt2e...

CVE-2026-48209

creationtimestamp| type| source ---|---|--- 2026-06-01 07:14:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7jtf3e432e...

CVE-2026-48191

creationtimestamp| type| source ---|---|--- 2026-06-01 07:05:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7jd4vsft2m...

CVE-2026-45192

creationtimestamp| type| source ---|---|--- 2026-06-01 05:38:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn7egkqk5j25 2026-06-01 11:06:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7wrkurec2b...

CVE-2026-35563

creationtimestamp| type| source ---|---|--- 2026-06-01 05:19:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mn7dekec2u2w 2026-06-01 08:49:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7p5irere26...

CVE-2026-10204

creationtimestamp| type| source ---|---|--- 2026-06-01 03:58:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn76tx7cre2v...

CVE-2026-10203

creationtimestamp| type| source ---|---|--- 2026-06-01 03:48:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn76bzxmz32q...

PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation

A flaw was found in PHP, specifically within the PHP-FPM status page. Due to improper sanitation of user data, a remote attacker can craft a malicious URL. When a user views the PHP-FPM status page with this crafted URL, it can lead to the execution of arbitrary JavaScript code Cross-Site Scripti...

PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation

A flaw was found in PHP, specifically within the PHP-FPM status page. Due to improper sanitation of user data, a remote attacker can craft a malicious URL. When a user views the PHP-FPM status page with this crafted URL, it can lead to the execution of arbitrary JavaScript code Cross-Site Scripti...

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API

A flaw was found in the Python webbrowser.open API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution...

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...

CVE-2026-49389

creationtimestamp| type| source ---|---|--- 2026-06-01 00:01:30+00:00| seen| https://bsky.app/profile/slackers.it/post/3mn6rmrienf2z...

PT-2026-45367

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.2 Description A bug in the bulk Task Instances API allows an authenticated UI or API user to bypass authorization and mutate Task Instance states across different DAGs. The system evaluates authorization...