112331 matches found
CVE-2026-7571
creationtimestamp| type| source ---|---|--- 2026-05-19 13:05:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7hdknyw22r...
EUVD-2026-30931
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication. The vendor was notified early about this vulnerability, but...
CVE-2026-8827
creationtimestamp| type| source ---|---|--- 2026-05-19 12:53:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7gotmhok2k 2026-05-19 13:01:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7h5lczbw2e...
CVE-2026-43491
creationtimestamp| type| source ---|---|--- 2026-05-19 12:50:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7gkp7sn32c 2026-06-06 17:22:00+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mnn63tbews2c 2026-06-06 17:22:00+00:00| seen|...
CVE-2026-37982
creationtimestamp| type| source ---|---|--- 2026-05-19 12:46:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm7gdbiiqv2t...
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further...
georgringer/news has SQL Injection in extension "News system" (news)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin ...
CVE-2026-7504
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further...
CVE-2026-42410
creationtimestamp| type| source ---|---|--- 2026-05-19 10:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm76sgru3z2u...
CVE-2026-42649
creationtimestamp| type| source ---|---|--- 2026-05-19 09:32:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm73h6o3dx2i...
CVE-2026-8726 SQL Injection in extension "News system" (news)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin ...
CVE-2026-8726
CVE-2026-8726 describes an SQL injection in the Typo3 extension experience: the extension fails to properly sanitize user input before using it in a database query, enabling an unauthenticated attacker to inject arbitrary SQL via a URL parameter on pages using the “Date Menu of news articles” plu...
CVE-2026-31378 Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution
Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...
CVE-2026-31378 Apache OFBiz: JSON Attribute Override and URL Allowlist Bypass Leads to Remote Code Execution
Improper Input Validation vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...
firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters
A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack...
CVE-2026-47311
creationtimestamp| type| source ---|---|--- 2026-05-19 09:11:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm72cduo6k2i...
CVE-2026-47310
creationtimestamp| type| source ---|---|--- 2026-05-19 09:02:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm6zsxod2n2o 2026-05-19 12:03:23+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mm7dvndnbf2o...
org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve
A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...
CVE-2026-29965
HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting XSS in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax...
EUVD-2026-30944
scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalarurl query parameter of the Scalar Proxy endpoint. This vulnerability allows attackers to execute arbitrary code via uploading a crafted SVG file...