CVE-2025-49867

creationtimestamp| type| source ---|---|--- 2026-04-25 21:03:13+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkdwukeft52x...

CVE-2025-31918

creationtimestamp| type| source ---|---|--- 2026-04-25 21:03:12+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mkdwukbvpi2g...

Server-side Request Forgery (SSRF)

Overview pagekit/pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the url argument in the /index.php/admin/system/update/download process. An attacker can access internal...

CVE-2026-6983

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit i...

EUVD-2026-25659

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit i...

GHSA-6FW5-F8R9-FGFM

creationtimestamp| type| source ---|---|--- 2026-04-25 11:36:33+00:00| seen| https://gist.github.com/dims/bd766118ae32d646ea9f127ac51c3054...

CVE-2026-41163

creationtimestamp| type| source ---|---|--- 2026-04-25 11:17:35+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkcw5o2cdu2s 2026-05-09 05:21:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlfisnqiqh2e...

CVE-2026-31682

creationtimestamp| type| source ---|---|--- 2026-04-25 10:06:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116464783504751353 2026-04-25 20:30:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116467237575005440 2026-05-05 20:00:00+00:00| seen|...

CLSA-2026-1776878817 squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

squid: Fix of 13 CVEs

CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection - CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages - CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from...

CVE-2026-40894

creationtimestamp| type| source ---|---|--- 2026-04-25 03:10:25+00:00| seen| https://bsky.app/profile/startdebugging.bsky.social/post/3mkc2wk6mhx2a...

CVE-2026-43873

creationtimestamp| type| source ---|---|--- 2026-04-25 00:46:54+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-qm9p-p5pw-jrx2 2026-05-12 05:38:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mln34ysrfi2t...

GHSA-H829-5CG7-6HFF

creationtimestamp| type| source ---|---|--- 2026-04-25 00:12:21+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mkbqxhjzmlu2...

PT-2026-35154

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-33666

creationtimestamp| type| source ---|---|--- 2026-04-24 21:49:26+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mkbiykg5m32w...

PYSEC-2026-76

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's urltosize helper used by getnumtokensfrommessages for image token counting validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS...

PYSEC-2026-76

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's urltosize helper used by getnumtokensfrommessages for image token counting validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS...

CVE-2026-41488

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's urltosize helper used by getnumtokensfrommessages for image token counting validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS...

CVE-2026-41328

creationtimestamp| type| source ---|---|--- 2026-04-24 19:42:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mkbbw67je32f 2026-04-25 04:30:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116463463879285208 2026-04-25 04:30:31+00:00| seen|...

Improper Encoding or Escaping of Output

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the encode function in AxiosURLSearchParams. An attacker can smuggle a NUL byte into serialized query strings by supplying...