110188 matches found
CVE-2026-45066
CVE-2026-45066 affects Symfony’s HtmlSanitizer: URL sanitization bypass due to UrlSanitizer::parse() following RFC 3986 while browsers use WHATWG, and because is checked against the media policy instead of the link policy. Affected versions: 6.1.0-BETA1–6.4.40, 7.4.12, and 8.0.12. Impact: off-al...
CVE-2026-45066 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...
CVE-2026-45066 Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...
CVE-2026-45066
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...
CVE-2026-45065
CVE-2026-45065 affects Symfony’s UrlGenerator in the Symfony PHP framework. Prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters with a pattern built as ^ + raw requirement + $, and ungrouped alternations can cause middle alternatives to match as unanchore...
CVE-2026-45065 Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives mat...
CVE-2026-60082
creationtimestamp| type| source ---|---|--- 2026-07-14 17:01:02+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqmongt66t2f 2026-07-15 15:40:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp2lniocx2l 2026-07-16 09:32:03+00:00| seen|...
CVE-2026-11403
creationtimestamp| type| source ---|---|--- 2026-07-14 16:44:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmnoybfes27...
CVE-2026-14645
CVE-2026-14645 : Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the Webhook: Global capability. The product does not validate the destination URL of the configured Webhook: Global before making an outbound HTTP request, enabling a user with the Capability Administratio...
CVE-2025-12011
creationtimestamp| type| source ---|---|--- 2026-07-14 16:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmmw375fu2t 2026-07-16 16:15:43+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06...
CVE-2026-15694
creationtimestamp| type| source ---|---|--- 2026-07-14 16:17:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmmafbgcm2z 2026-07-22 05:05:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kf73r4c2z...
CVE-2026-52840
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Caldav::connecttoserver at application/controllers/Caldav.php:60 hands the request's caldavurl to a Guzzle REPORT call without scheme or host validation. A logged-in backend user admin, provider, or secretary...
CVE-2026-51105
creationtimestamp| type| source ---|---|--- 2026-07-14 15:43:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqmkcoi4r42e 2026-07-22 05:03:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr7kb2qcoe24...
CVE-2026-53410
creationtimestamp| type| source ---|---|--- 2026-07-14 15:28:41+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mqmjicwo2y2e 2026-07-14 16:45:10+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-zoom-2 2026-07-16 14:23:57+00:00| seen|...
CVE-2026-52840
Affected software: Easy!Appointments (self-hosted) prior to 1.6.0. Vulnerability: Server-Side Request Forgery (SSRF) in the CalDAV connection test. In Caldav::connect_to_server (application/controllers/Caldav.php:60), the request’s caldav_url is handed to a Guzzle REPORT call without proper schem...
CVE-2026-55040
creationtimestamp| type| source ---|---|--- 2026-07-14 15:03:05+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116918936175684697 2026-07-14 18:17:37+00:00| seen| https://bsky.app/profile/captechgroup.com/post/3mqmswep6632k 2026-07-14 19:00:53+00:00| seen|...
CVE-2026-58478 Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL
Sustainable Irrigation Platform SIP through version 5.2.16 contains a server-side request forgery SSRF vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attacke...
CVE-2026-58478
SIP 5.2.16 has a server-side request forgery (SSRF) vulnerability when the optional Node-RED plugin is installed. An unauthenticated attacker can supply a malicious callback URL and cause the device to issue arbitrary HTTP requests due to lack of destination validation, aided by the default passp...
CVE-2026-15692
A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit ha...