112760 matches found
JLSEC-2026-119 Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user...
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host...
NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins
Summary NocoBase's workflow HTTP request plugin and custom request action plugin make server-side HTTP requests to user-provided URLs without any SSRF protection. An authenticated user can access internal network services, cloud metadata endpoints, and localhost. Vulnerable Code 1. Workflow HTTP...
CVE-2025-60991
creationtimestamp| type| source ---|---|--- 2026-04-15 19:20:49+00:00| seen| https://bsky.app/profile/adobedigest.bsky.social/post/3mjkmiin6ad26...
CVE-2026-20152
creationtimestamp| type| source ---|---|--- 2026-04-15 19:17:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkmbzpqxh2o 2026-04-16 17:19:57+00:00| seen| https://infosec.exchange/users/AAKL/statuses/116415528739254723 2026-04-16 18:00:00+00:00| seen|...
CVE-2026-40173
creationtimestamp| type| source ---|---|--- 2026-04-15 19:04:22+00:00| published-proof-of-concept| https://github.com/dgraph-io/dgraph/security/advisories/GHSA-95mq-xwj4-r47p 2026-04-15 22:37:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkxiotu4e2g 2026-04-15 23:27:13+00:00|...
CVE-2026-20136
creationtimestamp| type| source ---|---|--- 2026-04-15 18:35:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkjwvn37e2t 2026-07-03 10:46:24+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqelg5ydk2w...
CVE-2026-20081
creationtimestamp| type| source ---|---|--- 2026-04-15 18:33:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkjt2moz52a 2026-04-16 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/cisco-products-multiple-vulnerabilities20260417...
CVE-2026-39845 Weblate: SSRF via the webhook add-on using unprotected fetch_url()
Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround...
CVE-2026-39845
Weblate (web-based localization tool) has a vulnerability in versions prior to 5.17 where the webhook add-on did not apply SSRF protections. The root cause is exposure via the webhook add-on’s fetch_url() path, enabling potential SSRF risks as described in the CVE entry. The issue is fixed in ver...
CVE-2026-39845 Weblate: SSRF via the webhook add-on using unprotected fetch_url()
Weblate is a web based localization tool. In versions prior to 5.17, the webhook add-on did not utilize existing SSRF protections. This issue has been fixed in version 5.17. If developers are unable to update immediately, they can disable the webhook add-on as a workaround...
CVE-2026-6310
creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 21:12:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjksqevtfj2z 2026-04-15 23:26:54+00:00|...
CVE-2026-6307
creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 22:00:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkvg6qnoi2w 2026-04-15 23:26:54+00:00|...
CVE-2026-6302
creationtimestamp| type| source ---|---|--- 2026-04-15 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260416 2026-04-15 21:54:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkv3gnbe32z 2026-04-15 23:26:33+00:00|...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via “Contact Point Writer” role that by default grants permission to alert.notifications:write or alert.notifications.receivers:test actions. An attacker can gain unauthorized access to sensitive configuration data,...
CVE-2026-1636
creationtimestamp| type| source ---|---|--- 2026-04-15 15:51:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkastkvv52o...
CVE-2026-1852
creationtimestamp| type| source ---|---|--- 2026-04-15 15:46:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjkajv3ytc2r...
Important: Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
Critical: Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...