112488 matches found
CVE-2026-42261
PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts exposes an authenticated endpoint POST /api/skills/fetch-remote that fetches a user-supplied URL server-side and reflects the response body up t...
CVE-2026-8137 Totolink X5000R formDdns sub_458E40 buffer overflow
A vulnerability has been found in Totolink X5000R 9.1.0u.6369B20230113. This vulnerability affects the function sub458E40 of the file /boafrm/formDdns. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclos...
CVE-2026-8137
The CVE-2026-8137 entry affects Totolink X5000R (firmware 9.1.0u.6369_B20230113). The vulnerable component is the function sub_458E40 in /boafrm/formDdns, where manipulation of the submit-url argument causes a buffer overflow. Remote exploitation is possible, and the exploit has been disclosed pu...
CVE-2026-8137 Totolink X5000R formDdns sub_458E40 buffer overflow
A vulnerability has been found in Totolink X5000R 9.1.0u.6369B20230113. This vulnerability affects the function sub458E40 of the file /boafrm/formDdns. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclos...
CVE-2026-42272 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes %2F in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent %2f is not recognized...
CVE-2026-42272 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes %2F in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent %2f is not recognized...
CVE-2026-42272
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes %2F in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent %2f is not recognized...
EUVD-2026-28504
PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts exposes an authenticated endpoint POST /api/skills/fetch-remote that fetches a user-supplied URL server-side and reflects the response body up t...
CVE-2026-42261
PromptHub prior to v0.5.4 exposes an authenticated SSRF via POST /api/skills/fetch-remote in apps/web/src/routes/skills.ts. The endpoint fetches a user-supplied URL server-side and reflects the response (up to 5 MB) back to the caller. The isPrivateIPv6 check in apps/web/src/utils/remote-http.ts ...
SUSE CVE-2026-41654
Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...
CVE-2026-8114
creationtimestamp| type| source ---|---|--- 2026-05-08 01:44:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlcm7iakt22h...
CVE-2026-8034
creationtimestamp| type| source ---|---|--- 2026-05-08 01:29:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlclelfnyz2q...
CVE-2026-8112
creationtimestamp| type| source ---|---|--- 2026-05-08 01:24:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlcl3mddlw2c...
CVE-2026-7541
creationtimestamp| type| source ---|---|--- 2026-05-08 01:10:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlckbsejsj2t...
CVE-2026-41928
creationtimestamp| type| source ---|---|--- 2026-05-08 01:05:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlcjygcf5y2k...
n8n-MCP 安全漏洞
n8n-MCP is a model context protocol server developed by Romuald Członkowski, an individual developer. It serves as a connection between AI assistants and automated workflow platforms. Versions of n8n-MCP from 2.18.7 to 2.50.2 contained security vulnerabilities. These vulnerabilities were caused b...
PT-2026-39186
Name of the Vulnerable Software and Affected Versions Amazon Redshift JDBC Driver versions prior to 2.2.2 Description An issue allows the driver to load and execute arbitrary classes when processing JDBC connection URL parameters. An actor capable of influencing the connection URL could potential...
TOTOLINK X5000R 缓冲区错误漏洞
The TOTOLINK X5000R is a router produced by TOTOLINK, a Chinese electronics company. The version 9.1.0u.6369B20230113 of the Totolink X5000R contains a buffer error vulnerability. This vulnerability stems from improper handling of the submit-url parameter in the function sub458E40 within the...
Angular 代码问题漏洞
Angular is an open-source development platform created by Angular. It is used to build mobile and desktop web applications using TypeScript/JavaScript and other languages. There were code-related vulnerabilities in versions prior to Angular 19.2.21, 20.3.19, 21.2.9, and 22.0.0-next.8. These...
PT-2026-39263
Name of the Vulnerable Software and Affected Versions MCP Registry versions prior to 1.7.7 Description The public catalogue UI served at the 'GET /' endpoint is subject to stored cross-site scripting. This occurs via the server.websiteUrl field of published server.json files. The server-side...