Facebook WhatsApp 安全漏洞

Facebook WhatsApp is a suite of Android-based mobile applications from Facebook, Inc. in the United States that utilize the Internet to deliver text messages. The application uses the contact information in a smartphone to find contacts using the software to send texts, pictures, and more. A...

CVE-2025-69606

GSVoIP Web Panel 2.0.90 is affected by an XSS in the msg parameter of /painel/gateways.php/error, where user input is not properly sanitized. Root cause: lack of input validation/encoding allows arbitrary JavaScript in HTML response, enabling client-side attacks (e.g., script execution, session h...

CVE-2025-36122

creationtimestamp| type| source ---|---|--- 2026-04-30 22:52:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkqpd6gdh62o...

CVE-2026-3346

creationtimestamp| type| source ---|---|--- 2026-04-30 22:47:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkqoz2hd4x2v 2026-05-03 21:06:48+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mky2smzu6f2f...

CVE-2026-33452

creationtimestamp| type| source ---|---|--- 2026-04-30 22:01:13+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mkqmh6eclc2s 2026-04-30 22:09:37+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkqmw3qe7o32 2026-05-03...

CVE-2026-41220

creationtimestamp| type| source ---|---|--- 2026-04-30 22:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkqmg6e64r2q 2026-05-06 11:02:09+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3ml6kg6h6pv2h...

CVE-2026-3340

CVE-2026-3340 is a Server-Side Request Forgery (SSRF) in the IBM Langflow Desktop URL data source component affecting versions 1.0.0–1.8.4 . An authenticated attacker can cause the Langflow server to make arbitrary requests to internal or restricted network resources, potentially enabling network...

CVE-2026-3340 Server-Side Request Forgery (SSRF) in Langflow URL Component

IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-42595

creationtimestamp| type| source ---|---|--- 2026-04-30 19:10:29+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-chwh-f6gm-r836 2026-05-21 12:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmef26igky2y...

CVE-2026-42593

creationtimestamp| type| source ---|---|--- 2026-04-30 18:31:56+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-3cv5-q585-h563 2026-05-14 17:49:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltevnjauu2r...

CVE-2026-42591

creationtimestamp| type| source ---|---|--- 2026-04-30 18:31:27+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-rm4c-xj6x-49mw 2026-05-14 17:17:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltd3zcdo52v 2026-05-21 11:37:06+00:0...

n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

Impact In the SDK embedder path N8NDocumentationMCPServer constructor, getN8nApiClient, and validateInstanceContext, the synchronous URL validator in SSRFProtection.validateUrlSync had no IPv6 checks. IPv4-mapped IPv6 addresses such as http://::ffff:169.254.169.254 bypassed the cloud-metadata,...

CVE-2026-7164

creationtimestamp| type| source ---|---|--- 2026-04-30 18:07:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkq7ffyvby2t 2026-05-04 06:44:59+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/freebsd-security-advisory-av26-415 2026-05-04 14:19:13+00:00| seen|...

GHSA-CWCX-382V-8M9G Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Impact An authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo URL pointing at a private address e.g. http://127.0.0.1:999...

CVE-2026-7382

creationtimestamp| type| source ---|---|--- 2026-04-30 16:54:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkq3croerr2v...

CVE-2024-13971

creationtimestamp| type| source ---|---|--- 2026-04-30 16:36:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkq2bwcdzl2c...

CVE-2026-3861

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...

CVE-2026-0205

creationtimestamp| type| source ---|---|--- 2026-04-30 13:55:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkprcb5i6n2c 2026-05-01 02:58:40+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3mkr52zptik2e 2026-07-21 04:00:07+00:00| seen|...

CVE-2026-40687

creationtimestamp| type| source ---|---|--- 2026-04-30 13:50:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkpqz242uz27 2026-05-02 04:40:22+00:00| seen| https://vulnerability.circl.lu/bundle/1f150b5f-d6d1-40b6-94cc-7bd855a097ec 2026-05-25 20:02:13+00:00| seen|...

CVE-2026-7163 Assisted-service: assisted-service: authenticated users can gain administrative access to openshift clusters via credential disclosure

A vulnerability in the assisted-service REST API, an optional Assisted Installer assisted-service component in the Multicluster Engine MCE, allows an authenticated user with minimal namespace-scoped privileges to obtain administrative credentials for arbitrary clusters provisioned through the hub...