CVE-2026-41654 Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

CVE-2026-41654

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

CVE-2026-28201

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...

CVE-2026-28201

An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration i...

CVE-2026-43861

A flaw was found in mutt, an email client. The urlpctdecode function, which is responsible for decoding URL-encoded strings, does not correctly handle null termination characters. This vulnerability could allow a remote attacker, to manipulate how URLs are processed, potentially leading to a...

CVE-2026-41143

creationtimestamp| type| source ---|---|--- 2026-05-07 08:26:05+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mlas5zdtfw2c 2026-05-07 10:06:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlaxs4n5as2i...

CVE-2026-4348

creationtimestamp| type| source ---|---|--- 2026-05-07 06:54:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlan2hlf4i2n 2026-05-07 10:13:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlay6waate2q 2026-05-08 01:31:13+00:00| seen|...

CVE-2026-42217

creationtimestamp| type| source ---|---|--- 2026-05-07 06:27:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlalkn4i5m2r 2026-07-03 22:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mprkkrp2gp2t 2026-08-25 07:50:05+00:00| seen|...

CVE-2026-41202

creationtimestamp| type| source ---|---|--- 2026-05-07 06:17:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlakynbolz2e 2026-05-07 09:00:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/116532473442667986 2026-05-07 09:00:34+00:00| seen|...

CVE-2026-6214

creationtimestamp| type| source ---|---|--- 2026-05-07 05:40:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlaivfxfjp2o...

CVE-2026-44602

creationtimestamp| type| source ---|---|--- 2026-05-07 05:18:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlahose3q72t...

CVE-2026-41891

creationtimestamp| type| source ---|---|--- 2026-05-07 05:15:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlahjfoxve2e...

GHSA-C67R-GC9J-2QF7

creationtimestamp| type| source ---|---|--- 2026-05-07 05:10:29+00:00| seen| https://gist.github.com/alon710/536c02534caf441e3d6307e9b3c04050...

CVE-2016-7883

creationtimestamp| type| source ---|---|--- 2026-05-07 04:25:09+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mlaep7byzq2p...

CVE-2016-2212

creationtimestamp| type| source ---|---|--- 2026-05-07 04:25:08+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mlaep6hrzw2q...

CVE-2026-41413

CVE-2026-41413 affects Istio: when a RequestAuthentication jwksUri points to an internal resource, istiod makes unauthenticated HTTP GET requests without filtering localhost/link-local IPs, risking SSRF and data exposure to Envoy proxies via xDS. Patched in Istio 1.28.6 and 1.29.2; upgrade to tho...

GHSA-FQPH-J6V6-JVGX docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

Impact The URLInputHandler class in doclinggraph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no...

docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler

Impact The URLInputHandler class in doclinggraph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no...

CVE-2026-41670

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value directly from incoming SAML AuthnRequest messages as the destination for the SAML response, without validating it against the...

CVE-2026-41670

Admidio before 5.0.9 permits an attacker who knows a registered SP’s Entity ID to craft a SAML AuthnRequest with an attacker-controlled AssertionConsumerServiceURL, causing the IdP to send a signed SAML response containing user attributes to the attacker’s URL. The root cause is that ACS URL is t...