CVE-2026-15091

creationtimestamp| type| source ---|---|--- 2026-07-17 20:24:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulfbhtkk2j 2026-07-17 21:50:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquq7kpqwz2g 2026-07-18 17:01:21+00:00| seen|...

CVE-2026-54242 Statamic: Server-Side Request Forgery via Glide (DNS rebinding)

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remote hostname was validated as publicly...

CVE-2026-15322

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs...

CVE-2026-16074 AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-16074

CVE-2026-16074 affects AstrBot up to version 4.25.2. The vulnerability lies in the function update_plugin/update_all_plugins (file astrbot/dashboard/routes/plugin.py) where manipulation of the arguments download_url/download_urls/proxy enables server-side request forgery (SSRF). Exploitation may ...

EUVD-2026-45315

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

CVE-2026-7667

creationtimestamp| type| source ---|---|--- 2026-07-17 19:51:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqujlirgex2i 2026-07-18 15:01:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwjtcd3jt2f 2026-07-21 10:07:06+00:00| seen|...

GO-2026-5956 OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect in github.com/openrundev/openrun

OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect in github.com/openrundev/openrun...

GO-2026-5964 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel

SiYuan: Path Traversal via Double URL Encoding in /assets/path publish mode arbitrary file─read, Incomplete fix of CVE-2026-41894 in github.com/siyuan-note/siyuan/kernel...

CVE-2026-15093

CVE-2026-15093 affects IBM Engineering AI Hub versions 1.0.0, 1.1.0 and 1.2.0. Affected component: handling/validation of user-supplied URLs, enabling a remote attacker to redirect users to malicious websites due to improper URL validation. The IBM Security Bulletin consolidates multiple vulnerab...

CVE-2026-15093

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs...

CVE-2026-63101

creationtimestamp| type| source ---|---|--- 2026-07-17 19:23:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquhyemnbm2s 2026-07-19 07:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqy7ggzcb72m...

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch Summary The uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or...

CVE-2026-9762

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

CVE-2026-16072

creationtimestamp| type| source ---|---|--- 2026-07-17 18:05:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqudn6gv5x2s...

CVE-2024-23578

creationtimestamp| type| source ---|---|--- 2026-07-17 18:02:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqudic2y6f2i...

CVE-2026-12705

creationtimestamp| type| source ---|---|--- 2026-07-17 17:55:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqud3r4mxv2j 2026-07-28 16:51:30+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-07...

CVE-2024-42214

creationtimestamp| type| source ---|---|--- 2026-07-17 17:45:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqucj4shyl2o...

CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...