net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-42510

creationtimestamp| type| source ---|---|--- 2026-04-30 01:34:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkohvdktv52j...

CVE-2026-7446

creationtimestamp| type| source ---|---|--- 2026-04-30 00:32:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkoegbaukq2i...

PT-2026-36045

Name of the Vulnerable Software and Affected Versions Ricoh Web Image Monitor affected versions not specified Description An open redirect issue exists in multiple laser printers and MFPs implementing Ricoh Web Image Monitor. By accessing a specially crafted URL, a user can be redirected to an...

Important: composer

Issue Overview: Command injection via malicious Perforce repository definition CVE-2026-40176 Command injection via malicious Perforce source reference/url CVE-2026-40261 Affected Packages: composer Issue Correction: Run dnf update composer --releasever 2023.11.20260427 or dnf update --advisory...

PT-2026-36822

Name of the Vulnerable Software and Affected Versions n8n-MCP versions 2.47.4 through 2.47.13 Description The synchronous URL validator in SSRFProtection.validateUrlSync lacks IPv6 checks within the SDK embedder path, specifically affecting the N8NDocumentationMCPServer constructor,...

PT-2026-36820

Name of the Vulnerable Software and Affected Versions @clerk/clerk-js versions prior to 5.125.10 @clerk/clerk-js versions prior to 6.7.5 @clerk/shared affected versions not specified @clerk/nextjs affected versions not specified @clerk/backend affected versions not specified Description...

RHEL 9 : buildah (RHSA-2026:12030)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:12030 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

PT-2026-36816

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.17.1 Description An authenticated user with project.add permission can import a specially crafted project backup ZIP file. If the components/.json file within the ZIP contains a repo URL pointing to a private addres...

exploit-db-skill

Exploit-DB Skill Cross-Platform Small cross-platform helper...

CVE-2026-7426

creationtimestamp| type| source ---|---|--- 2026-04-29 23:00:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mko7cisnyw2n 2026-05-04 14:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mkztt3kj2m2h...

CVE-2018-25307

creationtimestamp| type| source ---|---|--- 2026-04-29 21:34:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mko2ja5g4i2q...

Exploit for OS Command Injection in Kubeai

CVE-2026-34940 — OS Command Injection in KubeAI via Model URL...

CVE-2026-7289

A vulnerability was found in D-Link DIR-825M 1.1.12. This issue affects the function sub414BA8 of the file /boafrm/formWanConfigSetup. The manipulation of the argument submit-url results in buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used...

CVE-2026-7099

creationtimestamp| type| source ---|---|--- 2026-04-29 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mkntwktvnx2s...

CVE-2018-25304

Free Download Manager 2.0 Build 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler SEH chain exploitation. Attackers can craft a malicious URL file that, when imported through the File Import Import...

CVE-2018-25304 Free Download Manager 2.0 Build 417 Local Buffer Overflow SEH

Free Download Manager 2.0 Build 417 contains a local buffer overflow vulnerability in the URL import functionality that allows attackers to trigger a structured exception handler SEH chain exploitation. Attackers can craft a malicious URL file that, when imported through the File Import Import...

CVE-2026-5161

creationtimestamp| type| source ---|---|--- 2026-04-29 16:31:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknjl225yv2k 2026-04-30 21:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkqj32em5u2c...

CVE-2026-6849

creationtimestamp| type| source ---|---|--- 2026-04-29 16:26:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknjc3gzjv2v 2026-04-29 19:01:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mknrx7v2472w...

Jenkins GitHub Plugin has an XSS vulnerability

In Jenkins GitHub Plugin versions 1.46.0 and earlier, the JavaScript that validates the "GitHub hook trigger for GITScm polling" feature improperly processes the current job URL. This results in a stored cross-site scripting XSS vulnerability exploitable by non-anonymous attackers with Overall/Re...