CVE-2026-8719

creationtimestamp| type| source ---|---|--- 2026-05-17 04:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlzk2kmiy32i 2026-05-17 17:12:56+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mm2ubcolsp2s 2026-05-18 05:18:36+00:00| seen|...

CVE-2018-25334

creationtimestamp| type| source ---|---|--- 2026-05-17 04:16:45+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2018-25334 2026-05-17 15:17:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2nt77cup2r...

CVE-2018-25335

creationtimestamp| type| source ---|---|--- 2026-05-17 04:16:45+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2018-25335 2026-05-17 14:33:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm2ldkldil2h 2026-05-25 07:46:43+00:00| seen|...

PT-2026-41587

Name of the Vulnerable Software and Affected Versions vercel ai versions prior to 3.0.98 Description A server-side request forgery SSRF issue exists in the provider-utils component. The flaw is located in the validateDownloadUrl function within the packages/provider-utils/src/download-blob.ts fil...

PT-2026-41550

Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp abspath values to simp...

Vercel AI SDK 代码问题漏洞

Vercel AI SDK is a JavaScript SDK developed by Vercel that supports the integration of large language models, streaming responses, and AI application development. Versions of Vercel AI 3.0.97 and earlier contain code vulnerabilities. These vulnerabilities stem from the validateDownloadUrl functio...

CVE-2026-8723

creationtimestamp| type| source ---|---|--- 2026-05-16 23:21:41+00:00| published-proof-of-concept| https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26 2026-05-17 00:32:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlz4e2r27x2h...

CVE-2021-47974

creationtimestamp| type| source ---|---|--- 2026-05-16 17:16:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlydyrh7z52i...

CVE-2021-47976

creationtimestamp| type| source ---|---|--- 2026-05-16 17:13:04+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlydpszapy2p...

CVE-2021-47955

creationtimestamp| type| source ---|---|--- 2026-05-16 16:37:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlybsrst222v...

EUVD-2020-31237

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject...

CVE-2020-37235

CVE-2020-37235 concerns WordPress Theme Wibar 1.1.8, where a stored XSS flaw exists in the Brand component. The vulnerability allows authenticated users with editor/administrator/contributor/author roles to inject base64-encoded script payloads via the ftc_brand_url input field, resulting in arbi...

CVE-2020-37235 WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject...

CVE-2026-5340

creationtimestamp| type| source ---|---|--- 2026-05-16 11:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlxqqwqisu2l...

Server-Side Request Forgery

Arcane is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the /api/templates/fetch endpoint accepting a user-controlled url parameter and performing server-side HTTP requests without authentication or validation of the URL scheme and destination host, allowing...

Server-Side Request Forgery (SSRF)

github.com/kyverno/kyvern is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the apiCall feature in ClusterPolicy automatically attaching the admission controller's ServiceAccount token to outbound HTTP requests without validating the destination URL, which allows an...

Server-Side Request Forgery (SSRF)

github.com/apache/skywalking-mcp is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the SW-URL header, which allows an attacker to supply arbitrary URLs and force the server to send requests to unintended internal or external resources...

Sensitive Information Exposure

Portainer Community Edition is vulnerable to Exposure of Sensitive Information. The vulnerability is due to the authentication middleware accepting JWT bearer tokens through the ?token= URL query parameter, which allows an attacker to obtain authentication tokens from browser history, proxy logs,...

Server-Side Request Forgery (SSRF)

n8n-mcp is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of webhook trigger tools, the n8n API client N8NAPIURL, and per-request URLs supplied through the x-n8n-url header in multi-tenant HTTP mode, which allows an authenticated attacker to send...

Improper Authorization

@fastify/express is vulnerable to Improper Authorization. The vulnerability is due to inconsistent URL normalization between Fastify and Express middleware, which allows an unauthenticated attacker to manipulate URL paths using duplicate slashes or semicolon delimiters to bypass path-based...