CVE-2026-37431

creationtimestamp| type| source ---|---|--- 2026-05-08 19:57:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlejbistw72c...

CVE-2026-42181 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP...

CVE-2026-8178

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application...

GHSA-FP53-QCF8-2XX2 Bunsink has an SSRF bypass in `validate_webhook_url`

Summary Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be partially bypassed because of a mismatch in URL parsing. In some malformed URLs, Python’s standard URL parser urllib and the HTTP client stack requests / urllib3 do not agree on which host is actually being targeted...

Server-side Request Forgery (SSRF)

Overview bugsink is a Self-hosted Error Tracking Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the validatewebhookurl process. An attacker can cause the application to send outbound HTTP POST requests to unintended hosts, including internal or...

CVE-2026-44499

creationtimestamp| type| source ---|---|--- 2026-05-08 18:38:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleeu5cpdq2v 2026-05-08 20:10:29+00:00| seen| https://gist.github.com/alon710/b2fb36b6ecfecf3424b0cb12c54264f5...

CVE-2026-8178 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application...

CVE-2026-8178

An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application...

CVE-2026-39215

creationtimestamp| type| source ---|---|--- 2026-05-08 18:19:08+00:00| seen| https://gist.github.com/cla7aye15I4nd/f9a7700240afe7ae8171ee65682e890f...

CVE-2026-44340

creationtimestamp| type| source ---|---|--- 2026-05-08 17:53:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleccwzhbj2k 2026-05-08 20:25:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlektkylyt2k 2026-05-11 14:10:29+00:00| seen|...

CVE-2026-29972

creationtimestamp| type| source ---|---|--- 2026-05-08 17:43:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlebs4aoxr2q 2026-05-08 18:25:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlee45z3g52p 2026-05-08 19:10:06+00:00| seen|...

GHSA-RQV2-M695-F8J4 MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

Summary The public catalogue UI served at GET / file internal/api/handlers/v0/uiindex.html is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go validateWebsiteURL only checks that the...

MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

Summary The public catalogue UI served at GET / file internal/api/handlers/v0/uiindex.html is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go validateWebsiteURL only checks that the...

CVE-2026-43472

creationtimestamp| type| source ---|---|--- 2026-05-08 17:08:09+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116540052992107234 2026-05-09 16:06:38+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116545473383071089 2026-08-03 07:13:46+00:00| seen|...

CVE-2026-41886

creationtimestamp| type| source ---|---|--- 2026-05-08 17:07:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mle7qhnbjg2w...

CLSA-2026-1778254382 buildah: Fix of CVE-2026-25679

rebuild on tuxcare9.6esu with newer golang version 1.25.7-1.el96.tuxcare.els2 to fix the following CVE: - CVE-2026-25679: fix insufficient validation of host/authority component in url.Parse - split golang BuildRequires by .el96 so each ELS platform pulls its own fixed golang version el96 -...

CVE-2026-43346

creationtimestamp| type| source ---|---|--- 2026-05-08 17:04:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mle7mpnjyz2p...

CVE-2026-41885

i18next-locize-backend is a simple i18next backend for locize.com which can be used in Node.js, in the browser and for Deno. Prior to version 9.0.2, i18next-locize-backend interpolates lng, ns, projectId, and version directly into the configured loadPath / privatePath / addPath / updatePath /...

CVE-2026-43967

creationtimestamp| type| source ---|---|--- 2026-05-08 16:15:20+00:00| published-proof-of-concept| https://github.com/absinthe-graphql/absinthe/security/advisories/GHSA-9mhv-8h52-q7q2 2026-05-08 18:41:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mleeymqjoz2p...

CVE-2026-42793

creationtimestamp| type| source ---|---|--- 2026-05-08 16:15:00+00:00| published-proof-of-concept| https://github.com/absinthe-graphql/absinthe/security/advisories/GHSA-qf4g-9fqq-mmm7 2026-05-08 19:03:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlegaauzd22q...