EUVD-2026-30568

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or...

CVE-2026-45035 Tabby: RCE via `tabby://run` URL Scheme

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.233, Tabby registers itself as the handler for the tabby:// URL scheme on all platforms. The URL scheme handler supports a run command that directly executes OS commands with no user confirmation, sanitization, or...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the logout process. An attacker can redirect users to arbitrary external websites by supplying a crafted url parameter. This is only exploitable if the configuration option enablelogout is set to true, and is most...

SimpleSAMLphp casserver: Open Redirect in logout

Summary The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either depending on configuration redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. There are a number of other things broke...

GHSA-CVRM-5HP6-H523 SimpleSAMLphp casserver: Open Redirect in logout

Summary The logout endpoint accepts a url query parameter to redirect to. casserver treats that url as trusted, and either depending on configuration redirects the browser there, or shows a "you've been logged out" page with a link to continue to that url. There are a number of other things broke...

CVE-2026-8454

creationtimestamp| type| source ---|---|--- 2026-05-15 14:36:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvklyctod2q 2026-05-15 20:15:00+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mlw5izwcdv2x 2026-05-16 11:41:16+00:00| seen|...

CVE-2026-42030

A flaw was found in MapServer, a system for developing web-based Geographic Information System GIS applications. A reflected Cross-Site Scripting XSS vulnerability in MapServer's Web Map Service WMS server allows an unauthenticated attacker to inject arbitrary HTML or JavaScript code into the...

CVE-2026-8425

creationtimestamp| type| source ---|---|--- 2026-05-15 11:41:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlvas5mldv2o...

Exploit for CVE-2026-42897

CVE-2026-42897 - Exchange Health Checker Outbound Rewrite Rule...

CVE-2026-6403

creationtimestamp| type| source ---|---|--- 2026-05-15 11:21:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlv7pim2z52h 2026-05-15 14:32:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlvkdulq3o2s...

CVE-2026-45062

creationtimestamp| type| source ---|---|--- 2026-05-15 10:55:59+00:00| published-proof-of-concept| https://github.com/php/frankenphp/security/advisories/GHSA-3g8v-8r37-cgjm 2026-05-16 09:50:05+00:00| seen| https://bsky.app/profile/dunglas.dev/post/3mlxl2h6gpc2k 2026-05-17 02:40:31+00:00| seen|...

CVE-2026-8398

creationtimestamp| type| source ---|---|--- 2026-05-15 10:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlv35uqdzj2k 2026-05-27 18:00:02+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/11739434-0930-4569-82cd-80d659d1039f...

CVE-2026-5229

creationtimestamp| type| source ---|---|--- 2026-05-15 09:00:31+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mluxsxr7ya2y 2026-05-15 10:00:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlv363rg662w 2026-05-15 11:31:06+00:00| seen|...

CVE-2026-8425

CVE-2026-8425 describes a Cross-Site Request Forgery in the WordPress Notify Odoo plugin (versions ≤ 1.0.1). The root cause is missing or incorrect nonce validation on the _updateSettings function, enabling unauthenticated attackers to alter the Notify Odoo URL and related settings (notification,...

EUVD-2026-30520

The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the updateSettings function. This makes it possible for unauthenticated attackers to change the Notify Odoo URL to ...

CVE-2026-46433

creationtimestamp| type| source ---|---|--- 2026-05-15 06:27:28+00:00| seen| https://bsky.app/profile/vincent.bernat.ch/post/3mlupbaxxvs2n...

CVE-2025-48512

creationtimestamp| type| source ---|---|--- 2026-05-15 04:36:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mluj2boe2j2n...

CVE-2026-44051

creationtimestamp| type| source ---|---|--- 2026-05-15 04:08:09+00:00| seen| https://bsky.app/profile/slackers.it/post/3mluh44cimk2b 2026-05-21 13:44:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmekhwn57y2r 2026-05-22 09:00:34+00:00| seen|...

CVE-2026-44054

creationtimestamp| type| source ---|---|--- 2026-05-15 04:08:09+00:00| seen| https://bsky.app/profile/slackers.it/post/3mluh44cimk2b...

CVE-2026-44015

Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery SSRF by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwar...