112269 matches found
curl: Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flow
Hi all, We've found an issue in lib/urlapi.c where redirecturl reads past the end of a heap buffer when the source URL it operates on lacks a "scheme://" prefix. This is reachable through documented public APIs curlurlset when the caller mixes CURLUGUESSSCHEME with a subsequent CURLUNOGUESSSCHEME...
EUVD-2026-31188
Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in dounitmail.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the theticket GET parameter directly into a JavaScript variable assignment. Attacker...
CVE-2026-9087
creationtimestamp| type| source ---|---|--- 2026-05-20 19:16:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmcmlpfepy2q...
GO-2026-4990 Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes in github.com/gotenberg/gotenberg
Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes in github.com/gotenberg/gotenberg...
CVE-2026-44924
creationtimestamp| type| source ---|---|--- 2026-05-20 18:43:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmckqoujmd2v...
CVE-2026-8342
creationtimestamp| type| source ---|---|--- 2026-05-20 18:40:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmckkh4dd52q...
CVE-2026-44926
creationtimestamp| type| source ---|---|--- 2026-05-20 18:38:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmckhmekmx2k 2026-05-23 02:02:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmie3qglzs2g...
CVE-2026-2955
creationtimestamp| type| source ---|---|--- 2026-05-20 18:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmck3o4xsg2s 2026-05-24 19:31:24+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmmpbeamgk2i...
CVE-2025-15369
creationtimestamp| type| source ---|---|--- 2026-05-20 17:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmcgqexd632c...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-34653
creationtimestamp| type| source ---|---|--- 2026-05-20 17:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmcfdp7xcn26...
GHSA-XX55-4RRG-8XG6
creationtimestamp| type| source ---|---|--- 2026-05-20 16:56:46+00:00| seen| https://bsky.app/profile/Whiskeyomega.cupoftea.social.ap.brid.gy/post/3mmceqyeaiq72...
Cross-site Scripting (XSS)
Overview symfony/html-sanitizer is a Provides an object-oriented API to sanitize untrusted HTML input for safe insertion into a document's DOM. Affected versions of this package are vulnerable to Cross-site Scripting XSS via incomplete URL attribute validation in UrlAttributeSanitizer. An attacke...
Interpretation Conflict
Overview symfony/html-sanitizer is a Provides an object-oriented API to sanitize untrusted HTML input for safe insertion into a document's DOM. Affected versions of this package are vulnerable to Interpretation Conflict via URL parsing and policy enforcement in UrlSanitizer/UrlAttributeSanitizer...
User Interface (UI) Misrepresentation of Critical Information
Overview symfony/html-sanitizer is a Provides an object-oriented API to sanitize untrusted HTML input for safe insertion into a document's DOM. Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via UrlSanitizer::parse in the...
Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2025-61726 DESCRIPTION: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally...
CVE-2026-21836
creationtimestamp| type| source ---|---|--- 2026-05-20 15:33:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmca3tnonx2q...
CVE-2026-46352
creationtimestamp| type| source ---|---|--- 2026-05-20 14:15:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qtiaud2c...