GHSA-XV9C-MJW8-79GF Sidekiq-cron is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL

Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting xss vulnerability via crafted URL being rended from cron.erb...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering process in cron.erb. An attacker can execute arbitrary JavaScript in the context of the user's browser by supplying a crafted URL. Details Cross-site scripting or XSS is a code vulnerability th...

PYSEC-2026-2317

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

CVE-2026-20168

creationtimestamp| type| source ---|---|--- 2026-05-07 14:40:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlbh2zrqup2k...

CVE-2026-33589

creationtimestamp| type| source ---|---|--- 2026-05-07 14:37:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbgwnlpar2h 2026-05-22 13:33:17+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mmh2d5wycd2b...

CVE-2026-30816

creationtimestamp| type| source ---|---|--- 2026-05-07 14:30:07+00:00| seen| https://infosec.place/objects/7874175f-aefb-4114-8cfb-e9c289bbee70...

CVE-2026-41643

creationtimestamp| type| source ---|---|--- 2026-05-07 14:06:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbf64y5jg2p 2026-05-07 21:06:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc4olm2532w...

CVE-2026-7414

creationtimestamp| type| source ---|---|--- 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7413/ 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7414/ 2026-05-07 14:00:00+00:00| seen| http://takeonme.org/cves/cve-2026-7415/ 2026-05-07 17:18:05+00:00| seen|...

CVE-2026-44407

creationtimestamp| type| source ---|---|--- 2026-05-07 13:49:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlbe7yrvv62v...

EUVD-2026-28383

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php line 42 and endpoints/payments/add.php line 40 uses an inline IP validation check FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE that does not block...

CVE-2026-41687 Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php line 42 and endpoints/payments/add.php line 40 uses an inline IP validation check FILTERFLAGNOPRIVRANGE | FILTERFLAGNORESRANGE that does not block...

CVE-2026-41654 Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

CVE-2026-41654

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

CVE-2026-28201

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...

CVE-2026-28201

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...

CVE-2026-43861

A flaw was found in mutt, an email client. The urlpctdecode function, which is responsible for decoding URL-encoded strings, does not correctly handle null termination characters. This vulnerability could allow a remote attacker, to manipulate how URLs are processed, potentially leading to a...

CVE-2026-41143

creationtimestamp| type| source ---|---|--- 2026-05-07 08:26:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mlas5zdtfw2c 2026-05-07 10:06:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlaxs4n5as2i...

CVE-2026-4348

creationtimestamp| type| source ---|---|--- 2026-05-07 06:54:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlan2hlf4i2n 2026-05-07 10:13:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlay6waate2q 2026-05-08 01:31:13+00:00| seen|...

CVE-2026-42217

creationtimestamp| type| source ---|---|--- 2026-05-07 06:27:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlalkn4i5m2r 2026-07-03 22:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mprkkrp2gp2t 2026-08-25 07:50:05+00:00| seen|...

CVE-2026-41202

creationtimestamp| type| source ---|---|--- 2026-05-07 06:17:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlakynbolz2e 2026-05-07 09:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116532473442667986 2026-05-07 09:00:34+00:00| seen|...