112557 matches found
CVE-2026-42140 Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter
PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery SSRF. The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain unauthorized access to protected resources by appending a semicolon and arbitrary text to the request URL, exploiting...
GHSA-RC95-PCM8-65V9 Quarkus has Authentication/Authorization bypasses
Quarkus version 3.32.4 is vulnerable to an authorization bypass issue GHSL-2026-099, in which semicolons matrix parameters in HTTP requests can be used to bypass security constraints, potentially allowing unauthorized access to protected resources. Unauthenticated or lower-privileged users can...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain unauthorized access to protected resources by appending a semicolon and arbitrary text to the request URL, exploiting...
CVE-2024-36891
creationtimestamp| type| source ---|---|--- 2026-05-04 16:29:11+00:00| seen| https://bsky.app/profile/buzzerintelligence.com/post/3ml23r5jh462s...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
JLSEC-2026-398
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTPS URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request HTTP...
JLSEC-2026-389
The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a different URL usingthe wrong host name when it is later retrieved.For example, a URL like http://example.com%2F127.0.0.1/, would be allowed bythe parser and get...
CVE-2026-7738
creationtimestamp| type| source ---|---|--- 2026-05-04 11:11:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkzjyicqro2o...
CLSA-2026-1777891107 python3.11: Fix of CVE-2026-4786
CVE-2026-4786: fix webbrowser %action substitution bypass of the dash-prefix safety check by validating the post-substitution URL and expanding %action before %s in UnixBrowser argument assembly...
CVE-2026-7727
creationtimestamp| type| source ---|---|--- 2026-05-04 07:25:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkz5ey3uj52n...
CVE-2026-7730
creationtimestamp| type| source ---|---|--- 2026-05-04 07:20:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkz53zib7c2i...
UBUNTU-CVE-2026-43861
mutt before 2.3.2 does not check for '\0' in urlpctdecode...
CVE-2026-43861
mutt before 2.3.2 does not check for '\0' in urlpctdecode...
CVE-2026-7728
creationtimestamp| type| source ---|---|--- 2026-05-04 07:10:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkz4k4l3vs2p...
CVE-2026-43861
mutt before 2.3.2 does not check for '\0' in urlpctdecode...
EUVD-2026-26899
mutt before 2.3.2 does not check for '\0' in urlpctdecode...
